Security & Data Protection — Kaison B2B Order Import

This page describes how the Kaison B2B Order Import app protects the data it handles. It complements the app's privacy policy, which lists what we collect and why.

1. Data minimisation

• Order text and uploaded files are processed in memory for one request and never written to disk, the database or logs.
• The app does not request access to customer names, emails, phone numbers or addresses. It uses the ID of a company contact only to attach a draft order to the right company, and does not store it.
• API scopes are limited to what the features need: read products, inventory, publications, companies and customers (for company contacts), write draft orders and payment terms.

2. Encryption

• In transit: all traffic to the app and to the Shopify API uses HTTPS (TLS). There is no plain-HTTP endpoint.
• At rest: store API access tokens, and the company names, PO numbers and order totals kept in import records and company memory, are encrypted with AES-256-GCM before they are written to the database. The key is held outside the database and is never written to logs or source code.
• Backups: the database is backed up daily, encrypted with AES-256 and kept for 14 days; the backup key is stored separately from the backups.

3. Retention

4. Access control and logging

• Kaison Global FZE is a single-operator company. One person has access to production systems; there are no shared or contractor accounts.
• Servers accept SSH key authentication only (password login disabled), behind a firewall that exposes only HTTPS and SSH. Operating-system security updates are applied automatically.
• The Shopify Partner account and all accounts used to operate the service are protected with strong, unique passwords and two-step verification.
• Every draft order created, every compliance webhook and every automatic deletion is written to an application log with the time, the store, the action and record IDs. Log entries never contain order text.
• Webhooks from Shopify are accepted only with a valid HMAC signature.

5. Test and production separation

Development uses a separate Shopify development app, a Shopify development store with made-up products and companies, and a local database. No production merchant data is copied into test systems.

6. Security incident response

1. Report. Anyone can report a suspected incident or vulnerability to support@kaisonapps.com (subject "Security"). We acknowledge reports within two business days.
2. Contain (within 24 hours of becoming aware). Rotate affected credentials and API secrets, isolate or take the affected service offline if needed, preserve logs.
3. Assess. Determine which stores and records were affected, using the access logs and backups.
4. Notify (within 72 hours of confirming a breach of personal data). Email every affected merchant with what happened, which data was involved, what we have done and what they should do; notify Shopify as required by the Shopify Partner Program Agreement.
5. Fix and review. Remove the cause, verify the fix, and record the incident, timeline and follow-up actions.

7. Sub-processors

8. Third-party audits

We have not undergone a third-party security audit or certification (such as SOC 2) at this time. This page will be updated if that changes.