Security & Incident Response Policy
Pod.AI — AI customer chat for Shopify stores · Operated by Dropking AI · Last updated: 9 November 2026
This policy describes how Dropking AI protects the data processed by the Pod.AI app and how we detect, handle and report security incidents, including any personal data breach affecting merchants or their customers.
1. Security controls
- Encryption in transit: HTTPS (TLS) for all storefront, admin, webhook and Shopify API traffic.
- Encryption at rest: all Pod.AI records (conversations, shopper e-mails, order numbers, handoffs, events, settings) are encrypted with AES-256-GCM at the application level; shop access tokens are encrypted separately. Keys are derived (HKDF-SHA256) from a secret kept only in the server's owner-only environment file, never in source code.
- Encrypted backups: daily, AES-256-GCM, stored outside web roots with owner-only permissions, retained 14 days; a documented, tested restore procedure.
- Access control and logging: merchant data is reachable only with a valid Shopify session token for that shop, a Shopify app-proxy signature, or an HMAC-verified webhook. Every access to personal data is written to an append-only access log (actor, action, time, record IDs; no data contents), retained 12 months. Server administration is restricted to Dropking AI administrators.
- Data minimisation: read-only Shopify scopes; orders are fetched live and not copied; card data is never stored; automatic deletion after the retention periods in the Privacy Policy.
2. Detection
We monitor application and server error logs, failed signature / session-token checks, unusual request volumes (rate limits), decryption failures, backup job results and Shopify / hosting-provider security notices. Anyone can report a suspected vulnerability or incident to support@swisspro.site (subject "SECURITY").
3. Severity levels
| Level | Examples | Response target |
|---|---|---|
| Critical | Confirmed unauthorised access to or disclosure of personal data; leaked keys or access tokens | Triage immediately, containment within 4 hours |
| High | Exploitable vulnerability without evidence of data access; prolonged outage of privacy webhooks | Within 24 hours |
| Medium / Low | Hardening gaps, non-exploitable bugs, failed backups | Within 7 days |
4. Containment, eradication and recovery
- Assign an incident owner and open an internal incident record (timeline, systems, data and shops affected).
- Contain: block the attack path, disable affected features, rotate secrets (app API secret, encryption key with re-encryption, server credentials), and invalidate affected Shopify access tokens so merchants re-authorise.
- Preserve evidence (logs, access log, affected files) before changes where possible.
- Eradicate the root cause, patch, and restore clean data from encrypted backups if needed.
- Verify the fix and monitor closely for recurrence.
5. Notification
- Merchants: if personal data of a merchant or its customers is (or is reasonably believed to be) affected, we notify each affected merchant without undue delay and at the latest within 72 hours of becoming aware, by e-mail to the shop's contact address and in the App. The notice describes what happened, the data and customers concerned, likely consequences, the measures taken and recommended next steps. The merchant, as controller for its customer data, decides on notifying its customers and authorities; we provide all information and assistance needed.
- Shopify: we notify Shopify of incidents affecting Shopify merchant or customer data within the same 72-hour window, through the Shopify Partner support channels, and follow Shopify's instructions.
- Authorities: where Dropking AI is itself the controller (merchant account data), we notify the competent supervisory authority within 72 hours where required by GDPR / Swiss FADP.
6. Post-incident review
Within 14 days of closing a Critical or High incident we complete a written post-mortem: timeline, root cause, impact, what worked, and corrective actions with owners and dates. Lessons learned are reflected in this policy and our controls. Incident records are kept for at least 3 years.
7. Review and contact
This policy is reviewed at least once a year and after every significant incident. Responsible party: Dropking AI. Security contact: support@swisspro.site.