Security & incident-response policy

What we protect

COD Flex reads a native Cash-on-Delivery order to score its refusal risk and to print a courier label. In doing so it processes the buyer’s name, phone, email and delivery address (Protected Customer Data, Level 1). It never processes card or bank details — Cash on Delivery is paid in cash at the door. The refusal memory it keeps is a one-way SHA-256 hash of the phone, never the raw value.

How the data is secured

• Hosting & transport: a single dedicated server in the European Union; all traffic is served over HTTPS/TLS.
• Access control: administrative access is restricted to the app owner over SSH using key-based authentication only — there are no shared passwords, and access to personal data follows least-privilege.
• Encrypted backups: the database is backed up nightly. Each backup is GPG-encrypted to a public key; the matching private key is held off the server, so a compromise of the server cannot decrypt the backups. Backups are retained for 14 days.
• Access logging: every read of a buyer’s protected fields is written to an audit log recording which fields were accessed, for which order, when, and why — never the values themselves.
• Data minimisation: we request only the customer fields we use, and store hashes rather than raw contact details wherever a value is not needed.
• Separation: development and testing use fictional data on Shopify development stores; real merchant customer data is never copied into test environments.

If a security incident happens

A security incident is any event that may have exposed, altered, or destroyed personal data, or compromised the systems that hold it. Our response:

1. Detect & contain (hour 0–1): on becoming aware of an incident we immediately isolate the affected component — rotating credentials, revoking tokens, and, if needed, taking the app offline — to stop any ongoing exposure.
2. Assess (hour 1–24): we determine what data and which stores were affected, using the access log and server logs, and whether personal data was actually exposed.
3. Notify (within 72 hours): if personal data was, or is reasonably likely to have been, breached, we notify the affected merchants and, where the GDPR applies, the relevant supervisory authority within 72 hours of becoming aware, and we notify Shopify. Notifications state what happened, what data was involved, and what merchants should do.
4. Recover: we restore from the most recent clean encrypted backup, verify integrity, and confirm the vulnerability is closed before bringing the service back.
5. Review: after every incident we document the root cause and the fix, and update this policy and our controls so the same class of incident cannot recur.

Reporting a vulnerability

If you believe you have found a security issue in COD Flex, please email gheorghe.beschea@overheat.agency with the details. We will acknowledge your report and work with you to resolve it. Please do not publicly disclose the issue until it has been fixed.