Security and incident response

In short: how we protect the data of online stores and their visitors, and what we do if something goes wrong. Details about the data we process are in our Privacy policy.

1. How we protect data

• Encryption in transit. All connections use HTTPS (TLS): between the browser and our servers, and between our servers and the connected platforms (Shopify, WordPress, Meta, Google).
• Encryption at rest. Data is stored on Cloudflare infrastructure, encrypted at rest (AES-256). Access tokens received from platforms (for example Shopify and Google) are additionally encrypted at application level, with AES-256-GCM and a key kept separately from the database.
• Keys never in the browser. Access tokens and keys aren't shown in any interface and never reach the visitor's or the merchant's browser.
• Restricted access. Access to the dashboard requires an account and password, with role-based permissions. Only the administrator of FELIX ONLINE CONCEPT SRL has access to production systems.
• Separate test data. Test stores and test accounts are kept separate from real ones.
• Abuse protection. The chatbot only answers on the client's domain, traffic is limited per visitor and per store, and text entered by visitors is treated as untrusted and filtered.
• Data minimization. From Shopify we read only what's needed for replies (products, pages, order status) and, for contacts, only the name, email and phone number. The data isn't sold and isn't used to train artificial intelligence models.
• Backups. Daily, kept for at most 30 days; access tokens are excluded from them.
• Logs. We keep technical request logs so we can detect and investigate problems.

2. What we do if an incident happens

An incident means any unauthorized access to, loss of or disclosure of data, or a vulnerability that could expose it. Our steps:

1. Detection and assessment. We check the report or alert right away and establish which data and which stores are affected.
2. Containment. We isolate the problem: we revoke and rotate the affected keys and tokens, block compromised access and, if needed, temporarily turn off the feature involved.
3. Investigation and remediation. We find the cause, fix it and restore data from backups where needed.
4. Notification. Without undue delay, and within 24 hours of confirming the incident at the latest, we notify the affected merchants and, for Shopify stores, Shopify. We explain what happened, which data is involved and what we've done. Where the GDPR requires it, we notify the Romanian data protection authority (ANSPDCP) within 72 hours at the latest, and merchants get the information they need to notify their own customers in turn.
5. Post-incident review. We document the incident and change what's needed so it doesn't happen again.

3. Report a security issue

If you've found a vulnerability or think your data is exposed, write to us at contact@moonchat.ro with the subject "Security". We acknowledge receipt within 2 business days at most. Please don't access data that doesn't belong to you, and give us time to fix the issue before making it public.