Security and data protection

1. The data we hold and why

• Client data: company details, logins, contracts, price lists, invoices, payments and messages. We need it to run and bill our fulfillment service.
• End-customer data: when a client sends us orders from its online store (Shopify, WooCommerce, Shopware) or its Amazon seller account, or enters or uploads them in the portal, we receive the ship-to name, address and phone number and the order note. Orders a client enters or uploads itself may also carry an e-mail address. We use this data only to pick, pack, ship and track that order, and to handle its returns.
• Technical logs: sign-ins, devices, sync runs and deliveries from connected stores. We use them to keep accounts safe and the service running.

We do not sell personal data. We do not use end-customer data for marketing.

2. We take only what we need

• From Shopify we ask only for the access our fulfillment service needs: orders, products, locations, inventory and fulfillments.
• End-customer data stays with the order it belongs to, in our portal and in our warehouse order system. We do not keep other copies.
• When a store owner asks what we hold about one of its customers, we tell them which data we hold within 30 days.

3. Who can see what

• Every table in our database has access rules. A client login sees only its own company. Partners see only their own work and never a client's prices or charges.
• Staff access can be limited to named clients. A person limited to one client cannot reach another.
• Staff can open an end customer's address in only one place, and every opening is logged.
• One login per person. We do not use shared logins. A portal login runs one session at a time, and a new device needs a code sent by e-mail.
• Every staff and admin login uses two-step login. A client company can also require two-step login for its own team.
• Staff passwords are at least 12 characters long, include a special character, are checked against known data breaches and are changed once a year.
• When a person leaves or changes role, we remove or reduce their access the same day.
• When staff open the portal as a client to help, that visit is logged.
• The owner reviews the access logs every two weeks, and each review is recorded.

4. Encryption

• All data is encrypted in transit (HTTPS/TLS) and at rest.
• The access keys for connected stores are kept in an encrypted vault. No signed-in user can read them.

5. Backups

• Our database is backed up, and the backups are encrypted.
• At least once a year we test a restore into a separate environment and record the result.

6. How long we keep data

• How long we keep it: for Amazon orders we receive through our app, we delete the customer’s name, address and phone number from all our systems 30 days after the order is delivered; if an order never ships, 30 days after it was received or cancelled. Afterwards we keep only the state and country, for reports. A daily job does the Amazon deletion.
• For Shopify, WooCommerce and Shopware orders, we keep the ship-to data with the order record for as long as we provide fulfillment services to the store owner, and afterwards as long as needed for returns, carrier claims, tax and other legal records.
• Other order records in our warehouse order system are kept for as long as needed for our business, tax and legal records. Our warehouse order system provider receives an Amazon order’s ship-to data only to pick, pack and ship it.
• Our staff see a customer's address only when they need it for an order, and each such view is logged.
• When a store owner or Shopify asks us to delete a customer's data, we delete it promptly, at the latest within 30 days; Shopify's automatic deletion requests are carried out the same day.
• When a store removes our app or disconnects, we stop receiving its orders and delete the access keys we held for it.
• Technical logs are deleted after 90 days. Money records, invoices, messages, contracts and audit records are kept.

7. Test data and live data stay apart

• We test store connections only on test stores we own, in a mode that never creates a real shipment.
• Test accounts are marked as tests. They never trigger real work and are left out of partner reports.
• Test logins use our own company addresses, never a real person's address.
• Shipping and payment tests use the providers' separate test keys.
• Load tests run only on a separate test database, never on the live one.
• We never copy real client or end-customer data into a test store, test account or test database. Test orders use made-up names and addresses.

8. Keys and passwords

• Keys for outside services are stored as protected secrets and read only when needed. They are not written in our code.
• Secrets are never shared by chat, e-mail or in documents. A secret that is exposed is replaced the same day.

9. Monitoring

• We check sign-in, the database and the server every 5 minutes, day and night, and get an alert when the app is slow or down.
• We check our connected services every 15 minutes.
• Sensitive changes and privacy actions are logged. Sign-in and device logs are kept for 90 days.
• We refuse messages from Shopify unless their signature matches.
• Our logs record the type of event and the store, never the contents of an order.

10. If something goes wrong

An incident is any event that puts personal data we hold at risk: data read, changed, deleted or shared by someone who should not have it, or data we can no longer reach. The owner leads every incident and decides on every notice. This is what we do:

1. Contain. We stop the leak first. That can mean ending sessions, disabling a login, revoking a key or store connection, pausing a sync, or taking a feature offline.
2. Assess. We work out what happened, what data was involved, which clients and end customers are affected, and whether the data was seen or taken.
3. Keep the evidence. We keep the logs and records. We pause the automatic log cleanup for the affected records until the review is done.
4. Fix. We close the cause, replace any exposed secret, and test the fix before we turn the feature back on.
5. Notify. See below.
6. Close. The owner signs off once the fix is live and the notices are out.

Who we notify, and when

The clock starts when we confirm that personal data was affected.

• Affected clients: without undue delay, and within 72 hours. We tell them what happened, what data was involved, what we did and what they should do.
• Shopify: for incidents that involve Shopify data, as Shopify's partner and API terms require, and within the same 72 hours at the latest.
• WooCommerce and Shopware stores: we notify the store owner directly, on the same timeline.
• End customers: we help the store owner tell its own customers. We notify end customers ourselves where the law requires it.
• Authorities: where the law requires it, within the time the law sets. This includes Texas and other US state breach-notification laws, and the GDPR for data of people in the EU.

If we do not know everything within 72 hours, we send what we know and follow up.

Records and review

We keep a written record of every incident: the timeline, what was affected, the decisions taken, every notice sent and the fix. We keep it for at least 3 years. Within 14 days of every incident we review what happened and improve our rules, tools or access where needed.

11. Service providers

These providers process data for us, each only for its part of the service:

Optional portal analytics and WhatsApp messages use further providers. Our Privacy Policy names them.

12. Review

We review these rules every year, and after every security incident.

13. Contact and reporting a problem

To report a security problem, or to ask about this page, write to office@xatlantica.com. Clients, partners, store platforms and anyone else can use this address.

Xatlantica LLC
17350 State Hwy 249, STE 220 #8586
Houston, TX 77064