Technical and Organizational Measures (TOMs)
Optizio Ltd has implemented the following Technical and Organizational Measures (TOMs) to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services, in accordance with Article 32 of the GDPR. These measures apply to the Code Bulk Shopify application.
1. Measures to Ensure Confidentiality (Art. 32 para. 1 lit. b GDPR)
1.1 Physical Access Control
- Optizio relies on top-tier cloud service providers (Cloudflare) which employ strict physical security controls at their data centers (e.g., 24/7 security, biometric access, CCTV). Optizio employees do not have physical access to the servers.
1.2 Logical Access Control
- Authentication: Multi-Factor Authentication (MFA) is strictly enforced for all critical systems and administrative access.
- Password Policy: Enforced use of strong, unique passwords (minimum 12 characters) managed via a secure password manager. Passwords are checked against known breached databases.
- Authorization: Role-Based Access Control (RBAC) is implemented, following the principle of least privilege. Access rights are reviewed quarterly and revoked immediately upon employee departure.
- Operator Endpoints: Administrative and operational endpoints are restricted to authorized operators and protected by upstream access controls (e.g., access policies or IP filtering).
1.3 Data Access Control
- Encryption at Rest: All data stored within Optizio’s Cloudflare infrastructure (D1 databases, KV namespaces, R2 buckets, and Durable Object storage), including discount code sets, job records, session tokens, and merchant identity records, is encrypted using industry-standard encryption (AES-256).
- Credential Handling: Shopify admin access tokens and Klaviyo OAuth tokens are stored encrypted at rest and are used only to perform operations on the Controller’s behalf.
2. Measures to Ensure Integrity (Art. 32 para. 1 lit. b GDPR)
2.1 Data Transfer Control
- Encryption in Transit: All network traffic and data transfers between users, the app, Shopify APIs, and Klaviyo APIs are encrypted using TLS 1.2 or higher.
2.2 Input Control
- Logging and Monitoring: Systems are configured to log and monitor access and operational events, and application errors are captured via a dedicated error-monitoring service (Sentry). This ensures traceability of who accessed, modified, or removed data.
- Job Traceability: Bulk operations are processed as discrete, tracked jobs with recorded state, counts, retry history, and error details, providing an auditable trail for each code set.
- Secure Development: A strict Secure Software Development Lifecycle (SDLC) is followed. Automated tools for static and dynamic code analysis, vulnerability scanning, and dependency checks are integrated into CI/CD pipelines, and deployments are performed through controlled pipelines.
3. Measures to Ensure Availability and Resilience (Art. 32 para. 1 lit. b and c GDPR)
3.1 Backup and Recovery
- Automated Backups: Data stored in Cloudflare D1 supports point-in-time recovery to any minute within the last 30 days. Recent per-store set summaries are cached and persisted in Cloudflare KV for durability.
- Retention: Backups are retained for 30 days and are securely deleted thereafter. Code set files stored in R2 and associated job records are deleted on set deletion or app uninstall, subject to normal backup cycles.
- Testing: Periodic tests are conducted to verify the integrity and recoverability of backups.
3.2 Incident Management
- Incident Response Plan: A documented Incident Response Plan is in place, defining roles (e.g., Incident Response Lead) and procedures for identification, containment, eradication, and recovery from security incidents.
- Breach Notification: Optizio commits to notifying affected controllers without undue delay (and regulatory bodies within 72 hours where applicable) after becoming aware of a personal data breach.
4. Procedures for Regular Testing, Assessment, and Evaluation (Art. 32 para. 1 lit. d GDPR)
4.1 Audits and Reviews
- Internal Audits: Regular internal audits are conducted to ensure compliance with internal policies and legal requirements.
- Penetration Testing: Penetration testing is conducted for major releases or significant architectural changes.
- Policy Reviews: The Information Security Policy, SDLC Policy, Incident Response Plan, and Backup Policy are reviewed at least annually or following significant changes.
4.2 Training and Awareness
- All employees and contractors undergo regular training on information security, data protection (GDPR), and incident reporting to ensure awareness of their responsibilities.