01How we protect data
- Only what delivery needs: from your store we read the order, product and customer details needed to fulfil and support your orders, and use them for nothing else.
- Encrypted in transit (HTTPS) and at rest, including backups. Store connections and credentials are additionally sealed with AES-256-GCM.
- Isolated per client: database row-level security keeps each client's records readable only by that client's own logins.
- Least privilege: staff see only what their role needs, sensitive actions need an extra code, and staff actions are recorded in an audit trail.
- Test and live data kept apart: development and testing never use real customer data.
- Limited retention: tracking data is deleted 90 days after a parcel ships; when you uninstall the Kexlo Shopify app, your store's customer data is deleted within 30 days; a customer's erasure request is carried out within 30 days.
02Security incident response
If we suspect an incident that affects merchant or customer data, we follow these steps:
- Detect and contain. The incident is escalated to the person responsible for security at once. Affected access is closed, credentials are revoked and systems are isolated as needed.
- Assess. We establish what data was involved, which merchants and customers are affected, and since when.
- Notify. Affected merchants are told without undue delay, and within 72 hours of confirming a breach of personal data, with what happened, what data was involved and what we are doing about it. Shopify is told when Shopify customer data is involved, and authorities when the law requires it.
- Recover. Keys and tokens are rotated, the cause is fixed and checked, and the service is restored.
- Learn. Every incident is reviewed and a safeguard is added so it cannot happen the same way again.
03Report a security issue
If you believe you have found a security issue or that your account has been compromised, email 24fulfillr@24f.site straight away. Please give us a reasonable chance to fix an issue before telling anyone else about it.