Write to stephane.rix@buyrecord.app with "Security" in the subject. Describe the issue and how to reproduce it. We acknowledge reports within two business days and tell you when it is fixed. Please do not access data that is not yours, do not degrade the service, and give us reasonable time to fix the issue before making it public. Machine-readable contact: /.well-known/security.txt.
Safeguards in place
Encryption: HTTPS for all traffic; the database and its backups are on an encrypted volume, and backups are also encrypted before they are written to disk. Store access tokens are encrypted; API keys and access tokens are stored only as hashes.
Minimal data: no shopper names, emails, addresses or phone numbers are requested or stored (see the privacy policy).
Isolation: the service runs under a dedicated, unprivileged system account, in rootless containers. The database is not reachable from the internet.
Updates: operating system security updates are installed automatically every day; application containers are rebuilt on their latest base images, and put live only after the test suite passes.
Access: administrator accounts at our providers use two-factor authentication.
Incident response
If we detect or are told of a security incident:
Alert: the operator (Stéphane Rix) is alerted at once, by our monitoring or by the reporter.
Assess within 24 hours: what happened, which systems and data are affected, and whether personal data is involved. We contain the issue first (for example: revoke keys and tokens, block access, take a component offline).
Notify: affected merchants are told without undue delay, and within 72 hours, with what happened, what data is concerned and what we are doing. When personal data is involved, we notify the French data protection authority (CNIL) within 72 hours of becoming aware of it, as the GDPR requires, and the people concerned when the risk to them is high. Shopify is notified as its partner terms require.
Fix and learn: we fix the cause, rotate any secret that may have been exposed, and check that the fix holds.
Record: every incident, even minor, is written in our incident log: date, discovery, impact, data concerned, actions, notifications sent.