Information Security Policy

Poyais Digital Reklamcılık ve Teknoloji Ltd. Şti. ("Poyais") · Poyais One
Effective date: 2026-10-18 · Owner: Poyais management · Reviewed: annually

• In transit: all traffic to Poyais One and to third-party APIs (Shopify, advertising platforms) uses HTTPS/TLS 1.2+. HTTP is redirected to HTTPS.
• At rest: sensitive fields (OAuth access and refresh tokens, including Shopify access tokens) are encrypted at application level with Fernet (AES-128-CBC + HMAC-SHA256). The keys are stored outside the database.
• Backups: daily backups are encrypted with GPG (public-key encryption) before they leave the server. The decryption key is not stored on the server.

Development and testing use a separate environment with its own database, credentials and encryption keys, and a Shopify development store. Production merchant data is not copied into test environments.

• Daily consistent database backups (sqlite3 .backup) with an integrity check, stored off-site and kept for 30 days.
• Restores are tested periodically.

• Access to production systems and merchant data is limited to named staff who need it for their role (least privilege).
• Server access requires personal SSH keys. Password-based SSH login is disabled.
• In the application, users can access only the merchant accounts they are members of. Administrative access is limited to the admin role.
• Access is removed promptly when a staff member leaves or no longer needs it, and access is reviewed at least every 6 months.

Every access to merchant store data (Shopify orders and sales reports) is logged with the user, merchant account, endpoint, timestamp, IP address and result. Logs are kept for 365 days. Server logins are recorded in system logs.

• Application passwords must be at least 10 characters and contain letters and digits. They are stored only as Argon2 hashes.
• Staff use unique passwords stored in a password manager, and enable two-factor authentication on every service that supports it (Shopify Partners, GitHub, hosting provider, email).

Data Retention Policy · Security Incident Response Policy · Privacy & Data Processing Notice · Data Processing Agreement