Security

Encryption

• In transit: every connection to SendDuo, its API and the forms on your store uses HTTPS (TLS). The database accepts connections only from the server itself.
• At rest: the database, uploaded images and backups are stored on an encrypted volume (LUKS2, AES-256).
• Backups: each nightly backup is also encrypted on its own before it is written, with a key whose private half is kept off the server.
• Secrets: access keys for connected stores (Shopify, WooCommerce) are encrypted in the database, and account passwords are stored only as one-way hashes.

Access control

• Access to production systems and to customer data is limited to the people who run SendDuo, and only as needed to operate and support the service.
• Servers accept SSH keys only (no passwords), and repeated failed log-ins are blocked automatically.
• Staff accounts use unique passwords of at least 12 characters with letters, numbers and symbols, kept in a password manager. Customer accounts need at least 8 characters, and log-in attempts are rate limited.
• Each workspace's data is kept separate from every other workspace.

Logging

Administrative actions on customer workspaces (such as approving, pausing or reviewing an account) are recorded with who did them, when and why. Server and application logs are kept for 14 days to investigate problems and misuse.

Data loss prevention

• Minimum data: we collect only what the service needs. From Shopify that is customers' names and email addresses, not phone numbers or addresses.
• No exports to third parties: customer data is never sold or shared beyond the subprocessors listed in our Privacy policy.
• Network: a firewall allows only web traffic and SSH; the database is not reachable from the internet.
• Backups: encrypted nightly backups are kept for 14 days so data can be recovered after a failure.
• Retention: data is deleted on the schedule in our Privacy policy, and when a store or a person asks for deletion.
• Test data: development and testing use separate databases with test data, never production data.

Security incident response

If we suspect a security incident, we follow these steps:

1. Triage. We confirm what happened and rate its severity: high (customer data exposed or at risk), medium (a weakness without known exposure) or low.
2. Contain. We stop the cause: revoke keys and sessions, block access, pause affected sending or take a system offline if needed.
3. Preserve evidence. We keep the logs and records needed to understand the incident.
4. Notify. For incidents affecting personal data we tell affected customers without undue delay, and within 72 hours where the law requires it, with what happened, what data was involved and what we are doing. Where a connected platform is involved (for example Shopify), we notify it as its terms require.
5. Fix and review. We fix the root cause, restore from backups if needed, and write down what we changed so it does not happen again.

The person running SendDuo is responsible for each step and for escalating to outside help when needed.

Report a security issue

If you find a vulnerability or think your data was exposed, write to support@sendduo.com. We respond as soon as we can and will keep you informed while we investigate.