Security Incident Response Policy

Poyais Digital Reklamcılık ve Teknoloji Ltd. Şti. ("Poyais") · Poyais One
Effective date: 2026-10-18 · Owner: Poyais management · Reviewed: annually and after every incident

This policy covers any event that could affect the confidentiality, integrity or availability of merchant data, including Shopify data, processed by Poyais One. Examples: unauthorized access, leaked credentials or tokens, data loss, a compromised server or account, and vulnerabilities reported by third parties.

• Incident lead: Poyais founder/CTO. Coordinates the response and makes decisions.
• Responders: staff with production access.
• Contact for reporting incidents: hello@poyaisone.com (subject: "SECURITY").

1. Detect and report. Anyone who notices a possible incident reports it to the incident lead immediately. Sources include monitoring alerts, the data access log, SSH logs and external reports.
2. Triage (within 4 hours). Confirm whether it is an incident, estimate its scope (which merchants and which data), and record a timeline.
3. Contain. Revoke or rotate the affected credentials (API keys, SECRET_KEY, FIELD_ENCRYPTION_KEY, Shopify app secret, staff passwords and SSH keys). Block the affected accounts or IPs, and take the affected systems offline if needed.
4. Eradicate and recover. Remove the cause, patch, and restore from encrypted backups if needed. Verify integrity before bringing systems back.
5. Notify. - Affected merchants: without undue delay, and no later than 72 hours after the breach is confirmed. The notice describes what happened, what data was affected, what we have done, and what the merchant should do. - Shopify: as its Partner Program Agreement and API Terms require, when Shopify data is involved. - Regulators where the law requires it (e.g. KVKK Board under Turkish Law No. 6698, and EU supervisory authorities under GDPR, within 72 hours).
6. Review (within 14 days). Write a post-incident report covering the root cause, impact, timeline and corrective actions, and update this policy and our controls.

All incidents, including false alarms, are recorded with date, description, actions and outcome. Records are kept for at least 3 years.

• Daily encrypted off-site backups with a tested restore procedure.
• Access to merchant data is logged and kept for 365 days.
• Production access is limited to named staff using SSH keys.