Prod Veristar · verified reviews, honest stars
Security incident response policy
Last updated: October 21, 2026
This policy describes how Prod Veristar ("we"), the operator of the Prod Veristar Shopify app, responds to security incidents that affect, or could affect, merchant or customer data processed by the app. A security incident is any confirmed or reasonably suspected unauthorized access to, or loss, disclosure, alteration or destruction of, that data.
1. Detection and reporting
- We monitor application and worker logs, failed webhook and job alerts, hosting and database provider notifications, and the app's access log of who viewed or exported personal data.
- Anyone (merchants, shoppers, researchers, providers) can report a suspected incident to prodveristar@gmail.com. Reports are acknowledged within 2 business days.
2. Containment
As soon as an incident is suspected we act to stop it: revoking or rotating affected credentials, API keys, access tokens and encryption keys, disabling affected features or accounts, blocking malicious traffic, and taking affected services offline if needed.
3. Assessment
We determine what happened, which systems and stores are affected, what data (if any) was exposed, the number of affected merchants and shoppers, and the risk to them, using application, access and provider logs. Every step and decision is recorded.
4. Notification
- Merchants: affected merchants are notified at their store contact email without undue delay and in any case within 72 hours of us becoming aware of an incident involving their data, with what happened, the data involved, likely consequences, the measures taken, and recommended actions. As data controllers, merchants can use this information to meet their own obligations to their customers.
- Shopify: we notify Shopify within 72 hours (or sooner if required by the Shopify Partner Program Agreement or API Terms) when an incident involves data obtained through Shopify's APIs.
- Authorities and individuals: we notify supervisory authorities and affected individuals where and as required by applicable law (for example GDPR / UK GDPR within 72 hours, and US state breach laws), and support merchants in doing so.
- If information is not yet complete, we notify with what we know and follow up as we learn more.
5. Remediation and recovery
We fix the root cause (for example patching code or dependencies, correcting configuration, tightening access), restore affected services and data from trusted backups where needed, and verify the fix before returning to normal operation.
6. Post-incident review
Within 30 days of resolution we complete a written review covering the timeline, root cause, impact, and the improvements to prevent recurrence, and we track those improvements to completion. Incident records are kept for at least one year.
Contact
Report security issues to prodveristar@gmail.com. See also our privacy policy.