CreditOps Security & Incident Response Policy

Last updated: July 10, 2026

This policy describes how Talivio Technology OÜ, the operator of CreditOps, protects the personal data (customer name and email) that the app processes, and what we do if a security incident affects it. It supplements our Privacy Policy.

1. Scope

CreditOps is operated by a single-person team. This policy is intentionally sized to that reality: it is a concrete, followable process rather than a framework built for a larger organization. It covers the production server, database, and source code repository that store or process merchant and customer data on our behalf.

2. What we protect

• Store credit account and transaction data synced from Shopify.
• Customer name and email, synced only for customers who hold a store credit balance.
• Bulk top-up CSV files uploaded by merchants (email + amount per row).
• Shopify access tokens used to call the Admin API on a merchant's behalf.

3. Preventive measures currently in place

We disclose gaps here rather than overstate our posture; merchants evaluating the app should weigh this against the sensitivity of the data involved (store credit balances and customer name/email — no payment card data, and no data beyond what Shopify itself already holds).

4. What counts as a security incident

Any event that risks the confidentiality, integrity, or availability of the data in section 2 — for example, unauthorized access to the production server or database, a leaked or compromised Shopify access token, loss of a device with access to production systems, or a vulnerability that could have been exploited to read or alter merchant or customer data.

5. Response process

1. Detect. Via server/application error monitoring, Shopify API error alerts, or a report from a merchant, security researcher, or Shopify.
2. Contain. Revoke or rotate the affected credentials (Shopify access tokens, server/DB credentials, deploy keys) immediately; if the production server itself is compromised, take the affected service offline rather than leave it exposed.
3. Assess. Determine what data was accessible, to whom, and for how long, using application logs, the personal-data-access audit log (section 3), and server access logs.
4. Notify.
   • If personal data of an identifiable person was or is likely to have been affected, we notify the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) within 72 hours of becoming aware, as required by GDPR Article 33, unless the incident is unlikely to result in a risk to the affected individuals.
   • We notify affected merchants without undue delay by email, with what we know at the time and what we're doing about it.
   • If the incident is likely to result in a high risk to customers of a merchant's store, we support the merchant in meeting their own notification obligations under GDPR Article 34.
5. Remediate. Fix the underlying cause (patch, config change, credential rotation, code fix) before restoring the affected service.
6. Review. After the incident is resolved, document what happened, why, and what changes (technical or process) will prevent a repeat. This policy is updated if the review identifies a gap in it.

6. Reporting a security issue

If you believe you've found a security vulnerability in CreditOps, please report it to [email protected]. We ask that you give us a reasonable opportunity to investigate and address a report before disclosing it publicly, and that you don't access, modify, or delete data that isn't yours while investigating.

7. Contact

Talivio Technology OÜ (registry code 16991406), Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia — [email protected].