Security Incident Response Policy

1. Purpose

This policy defines a structured process for identifying, responding to, and resolving security incidents affecting Orbitra Commerce’s platform, infrastructure, connected-channel credentials, merchant catalogue/order data, or end-customer (buyer) information. It ensures incidents are handled quickly, transparently, and in compliance with GDPR and the data-handling requirements of the marketplaces Orbitra connects to (Shopify, eBay, Amazon SP-API).

2. Scope

This policy applies to all Orbitra Commerce systems, employees, contractors, and third-party service providers with access to company, merchant, or buyer data — including data held or processed via Shopify, eBay, Amazon SP-API, Shiprocket, ShipStation, Chargebee, Firebase, and Cloudinary/AWS S3.

3. Definition of a security incident

A security incident is any event that threatens the confidentiality, integrity, or availability of Orbitra Commerce services or data. Examples specific to Orbitra’s architecture include:

• Unauthorized access to a merchant’s Orbitra account or to their connected marketplace credentials (Shopify, eBay, or Amazon OAuth tokens/API keys, encrypted at rest during the channel-connection flow)
• Exposure or leakage of order-level buyer data — name, email, delivery address — sourced from eBay or Amazon orders, including any exposure of the restricted buyer PII Amazon releases only under a specific data-access permission
• Cross-merchant data exposure in the shared multi-tenant platform (e.g., one merchant’s catalogue, stock pool, or order data becoming visible to another)
• Malicious or malformed files submitted through CSV bulk catalogue import
• Unauthorized use of the read-only AI assistant (“Ask Orbitra”) or the Claude/MCP connector to extract merchant data beyond its intended read-only scope
• Compromise of shipping-label credentials or accounts (Shiprocket, ShipStation) enabling fraudulent label purchases charged to a merchant’s Orbitra bill
• Billing-data incidents via Chargebee (subscription, invoice, or usage data) — noting Orbitra does not store buyer payment card data itself; buyer payments are collected and processed by the marketplace, not Orbitra
• Malware, ransomware, or injection attacks against Orbitra’s application or server infrastructure
• Denial of Service (DoS/DDoS) attacks against Orbitra’s infrastructure or its channel-sync/polling services
• Misuse or loss of internal access credentials (including Firebase-authenticated accounts)
• Unintended disclosure of personal data under GDPR or other applicable data-protection law

4. Roles and responsibilities

Incident Response Team (IRT)

Core security and engineering members responsible for investigating, containing, and resolving incidents, including coordination with the teams owning each third-party integration (Shopify/eBay/Amazon channel sync, Shiprocket/ShipStation shipping, Chargebee billing).

All employees & contractors

Required to immediately report suspicious activity, phishing attempts, or potential breaches.

Security Lead

Ensures incident documentation, coordinates notifications (merchants/buyers/regulators/marketplace partners), and manages root cause analysis.

5. Incident response process

• Identification – Detect incidents through monitoring, automated alerts, connection-health monitoring on connected channels, penetration testing, or user reporting.
• Containment – Immediately limit exposure by isolating compromised systems, suspending affected merchant accounts, revoking compromised marketplace/shipping credentials, or restricting access.
• Eradication – Remove malicious files, unauthorized access points, and vulnerabilities that caused the incident.
• Recovery – Restore impacted services (including re-establishing channel connections and verifying stock-pool integrity before resuming sync) and verify systems are secure before resuming normal operations.
• Lessons Learned – Conduct a post-mortem review within 7 business days to analyze root cause, document response actions, and implement preventive measures.

6. Communication and notification

• All incidents must be logged in Orbitra Commerce’s internal incident management system.
• Affected merchants will be notified promptly if their data, connected-channel credentials, or listings are impacted.
• Where a breach affects buyer (end-customer) data obtained through a connected marketplace, the affected marketplace (Shopify, eBay, or Amazon) will also be notified per that platform’s own data-protection and developer-program requirements.
• Notifications to regulators (e.g., GDPR supervisory authorities) will be made within required timelines.
• External communication will only be handled by authorized personnel to maintain accuracy and transparency.

7. Data protection and compliance

Orbitra Commerce complies with:

• GDPR for EU/EEA merchants and buyers
• Shopify Partner Program data-protection and app-security requirements (Shopify is a catalogue/source channel only — Orbitra does not process Shopify orders or payments)
• eBay Developer Program policies governing listing, order, and buyer-data access
• Amazon SP-API Data Protection Policy, including Amazon’s restrictions on buyer PII access and retention
• Best practices in application and cloud security (encryption of credentials at rest, access controls, connection-health monitoring, monitoring of image/asset storage via Cloudinary/AWS S3)

8. Training and awareness

All employees handling merchant or buyer data receive regular training on incident detection, reporting, and response procedures — including handling of marketplace API credentials and restricted buyer PII.

9. Review and maintenance

This policy will be reviewed annually, or following any major incident, to ensure its effectiveness and alignment with legal, regulatory, and marketplace-partner requirements.