Security Incident Response Policy — Pareto B2B Quotes

Last updated: 2026-08-19

Responsible person: Nikola Posarac

Contact: nikola@pareto-labs.com

This policy defines how we respond to a security incident or personal data breach affecting the Pareto B2B Quotes application.

1. What counts as an incident

Any event that compromises the confidentiality, integrity, or availability of personal data or systems — e.g. unauthorised access, data leak, lost credentials, malware, or a breach reported by a sub-processor (Shopify, Render, Neon, Resend, PostHog).

2. Response steps

1. Detect & log — record what happened, when, and how it was noticed.
2. Assess — determine the scope: what data, how many people, what severity.
3. Contain — stop the exposure (rotate keys/tokens, revoke access, patch, isolate the affected component).
4. Eradicate & recover — remove the cause and restore normal, secure service, using encrypted backups if needed.
5. Notify:
   • Affected merchants — without undue delay when their data is affected.
   • Supervisory authority — within 72 hours of becoming aware, where a personal data breach is likely to result in a risk to individuals (GDPR Art. 33).
   • Shopify — as required by the Partner Program / API terms.
   • Affected individuals — where the breach is likely to result in a high risk to them (GDPR Art. 34).
6. Post-incident review — document root cause and corrective actions to prevent recurrence.

3. Preventive measures

• Encryption at rest and in transit; encrypted backups.
• Restricted access to production data; strong authentication (2FA) on all administrative accounts (Shopify Partner, Render, Neon, email, Resend).
• Separation of test and production data.
• Least-privilege API scopes.

4. Records

Each incident is recorded with its timeline, impact, notifications sent, and remediation. This policy is reviewed at least annually.