Security and Incident Response

This page describes how Confirm Zone protects the personal data of merchants and their customers, and what we do if something goes wrong.

How we protect data

• All traffic uses HTTPS. Meta access tokens and courier keys are stored encrypted.
• Customer data is deleted automatically 90 days after it is created.
• The database is backed up every day. Backups are encrypted and the latest 14 are kept.
• Access to administration tools needs a strong password and is limited to the owner. Every view of customer data and every change in those tools is written to an access log.

Security incident response plan

A security incident is any event that may expose, change or destroy personal data without permission.

1. Detect and report. Anyone who notices a problem, including merchants, emails support@conformzone.tech. We also review server logs and the admin access log.
2. Contain. We immediately cut off the cause: change passwords and keys, revoke tokens, disconnect affected WhatsApp sessions and, if needed, take the service offline.
3. Assess. We find out what happened, which stores and which data were affected, and for how long.
4. Notify. We tell affected merchants and, where the law or Shopify requires it, the authorities and Shopify, without undue delay and within 72 hours of confirming the incident.
5. Recover and fix. We restore from a clean encrypted backup if needed, fix the root cause and test the fix.
6. Review. We write down what happened and what we changed, and update this plan and our controls.

Contact

Security questions or reports: support@conformzone.tech.