Security and incident response policy

Tradora: Wholesale & Quotes by Mulmil · Last updated 18 October 2026

How data is protected

• All traffic uses HTTPS (TLS). Data is stored in Cloudflare D1, which is encrypted at rest; Cloudflare's automatic point-in-time backups (30 days) are encrypted too.
• Production and test data are separated: production stores use the production service and database; development and testing use a separate staging service with its own database and no production data.
• Only the developer account owner can access the hosting account and databases; access uses a strong, unique password.
• Every access to store or customer data through the app (admin pages, storefront form submissions, Shopify data webhooks) is written to an access log with time, store and actor. Logs are kept for 13 months.
• Personal data is kept only as long as described in the privacy policy and is deleted on Shopify's redaction requests.

Incident response

A security incident is any suspected or confirmed unauthorised access to, loss of, or disclosure of merchant or customer data, or a compromise of our credentials or systems.

1. Detect and report. Incidents can be found through hosting and access logs, Shopify notices, or reports from merchants and researchers sent to indianecomking@gmail.com. Every report is acknowledged within 24 hours.
2. Contain (within hours). Rotate the Shopify client secret and hosting/API tokens, revoke affected access tokens, and disable affected endpoints if needed.
3. Assess. Use the access log and hosting logs to find what data, stores and customers were affected, and how.
4. Notify. Inform Shopify and affected merchants without undue delay and no later than 72 hours after confirming an incident that affects personal data, with what happened, what data was affected and what we are doing. Merchants can then meet their own legal duties (for example under GDPR).
5. Recover. Fix the cause, restore data from encrypted backups where needed, and confirm the fix before re-enabling services.
6. Review. Within 14 days write a post-incident review with root cause and preventive actions, and update this policy.

This policy is reviewed at least once a year.

Contact

Security reports: indianecomking@gmail.com