Legal
Parcelo — Security Incident Response Policy
Owner: Twin Ecom · Contact: support@twinecom.com · Last updated: 2026-08-30
Purpose & scope
This policy defines how Twin Ecom detects, responds to, and reports security
incidents affecting Parcelo and the personal data it processes. Parcelo is an
embedded Shopify app hosted on Railway (PostgreSQL). The personal data it holds is
limited to customer phone numbers (used for delivery return-risk scoring) and
merchant courier API tokens (stored encrypted). A “security incident” is any
actual or suspected event that compromises the confidentiality, integrity, or
availability of that data or the systems that hold it — e.g. unauthorized access,
data leak, credential compromise, or a breach at a service provider (Railway,
GitHub, Shopify).
Roles
Twin Ecom is a small team; the app owner is the incident lead and is
reachable at support@twinecom.com. The lead coordinates response, decides
severity, and owns all notifications. If the lead is unavailable, any team member
with Railway/Partner Dashboard access acts in their place.
Detection
Incidents are surfaced from: Railway platform and log alerts, application error
logs, GitHub/Railway/Shopify security advisories and Dependabot alerts, and
reports from merchants or Shopify. Anyone who suspects an incident reports it to
support@twinecom.com immediately.
Severity
– High — confirmed or likely exposure of personal data (phone numbers) or
courier tokens, or loss of production data.
– Medium — a vulnerability or misconfiguration that could lead to exposure
but with no evidence data was accessed.
– Low — contained issue with no data-protection impact.
## Response steps
1.Identify & record. Open a timestamped incident record: what happened, when
detected, systems and data involved, current severity.
2. Contain. Stop the bleeding — rotate exposed credentials (`SHOPIFY_API_SECRET`,
`ENCRYPTION_KEY`, database and courier tokens), revoke sessions, and if needed
take the app offline or restrict access.
3. Eradicate. Find and fix root cause — patch the vulnerability, close the
access path, deploy the fix.
4. Recover. Restore from Railway backups if data was lost, verify integrity,
and confirm the app is operating normally.
5. Notify (see below).
6. Review. Within 7 days of closure, run a post-incident review: root cause,
timeline, what worked, and concrete fixes to prevent recurrence.
Notification
For any incident involving personal data or Shopify-provided data, Twin Ecom will,
without undue delay and within 72 hours of confirming the incident:
– Notify Shopify as required by the Shopify API License and Terms and the
Protected Customer Data requirements.
– Notify affected merchants (via support@twinecom.com), describing what
happened, the data involved, our response, and any action they should take.
– Notify data-protection authorities and/or affected individuals where
required by applicable law.
Prevention & safeguards
Data is encrypted in transit (TLS) and at rest; courier tokens are encrypted with
a dedicated key; access to production systems is limited to the app owner and
protected by 2FA; access to customer personal data is logged (structured
`pii_access` entries in the platform logs whenever phone data is viewed or
exported); personal data is retained no longer than 180 days; and test and
production data are kept separate. This policy is reviewed at least annually
and after any High-severity incident.