Security Incident Response Policy

TruSend notifies affected customers of a personal data breach affecting their data without undue delay after becoming aware of it, as set out in section 4.6 of our Data Processing Agreement. Where an actual or suspected breach involves data received from Shopify, we also notify Shopify immediately and no later than 24 hours after becoming aware of it, as the Shopify API License and Terms require. This page describes, for information, the procedure by which we meet these commitments. It does not form part of the Data Processing Agreement or the Terms of Service; our commitments are those in the DPA, including section 4.6 and Annex II.

1. Purpose and scope

A security incident is any event that threatens the confidentiality, integrity or availability of TruSend systems or the data in them. A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed (GDPR art. 4(12)).

• Systems — the TruSend platform (Portal, the Nerv widget and SDK, our backend services and identity provider) and the infrastructure under it: our servers at Hetzner, Neon Postgres, Cloudflare, and the providers listed on the subprocessors page.
• Data — your end-users’ conversations, contacts and attachments; customer account and billing data; data received from integrations such as Shopify; and the credentials and keys that give access to any of these.
• Reporting sources — monitoring alerts, TruSend personnel, customers, Shopify, subprocessors, and external security researchers through security@trusend.ai.

2. Roles

The incident lead declares the incident and its severity, decides on notifications and signs them. The technical lead contains and investigates, preserves evidence, restores service and rotates credentials. Either lead may initiate the incident response. If either lead cannot be reached for 4 hours, the other lead assumes that lead’s role as well.

The lead who first becomes aware of a possible incident informs the other lead immediately by phone or direct message, and not by email alone.

3. Severity levels

Severity is set when the incident is declared and raised as soon as new facts warrant it. It is lowered only after the investigation confirms that a lower level applies. Response times run from the moment TruSend becomes aware of the incident.

• SEV-1, critical — personal data confirmed or very likely exposed, or the platform down for all customers. For example, leaked database credentials, cross-tenant data visible, or a compromised production server. Response starts within 1 hour.
• SEV-2, high — a breach possible but unconfirmed, or one customer’s data or a core feature affected. For example, suspicious access in logs, a subprocessor reporting an incident, or one integration’s token leaked. Response starts within 4 hours.
• SEV-3, low — no personal data at risk. For example, a vulnerability report with no sign of exploitation, or an attack blocked by our controls. Response starts within 2 business days.

SEV-1 incidents, and SEV-2 incidents found to involve personal data, are treated as personal data breaches and follow the notification timeline below. A suspected breach of data received from Shopify is reported to Shopify whether or not it has been confirmed.

4. Response steps

The notification timeline starts when TruSend becomes aware of a likely personal data breach. Where data received from Shopify may be involved, Shopify is notified by hour 24, whether or not the assessment is complete. The internal assessment is completed by hour 24. Affected customers are notified without undue delay.

1. Detect and declare (hour 0)

Open an incident record, set the severity and notify the other lead.

2. Contain (as fast as possible)

Revoke or rotate exposed credentials and keys, block the access path, and take an affected service or server offline if that stops the exposure. Containment comes before root-cause work.

3. Preserve evidence (day 0)

On the day the incident is declared, and before making any change not required for containment, export the relevant logs into the incident record and, where possible, take a snapshot of the database and the affected server.

4. Assess (by hour 24)

Determine the affected customers, the categories and approximate number of data subjects and records concerned, the cause, whether the incident is ongoing, and the likely consequences and level of risk to the rights and freedoms of data subjects. The assessment determines who is notified.

5. Notify (Shopify by hour 24, customers without undue delay, supervisory authority within 72 hours where required)

Notify on the basis of the information available and provide further information in phases as it becomes available (GDPR art. 33(4)).

6. Recover

Fix the cause, restore from backup where data was lost or altered, and confirm the fix in production. The database can be restored to any point in the last 7 days or from a daily snapshot kept for 7 days.

7. Review (within 2 weeks of closing)

Prepare a post-incident review and track each follow-up action with an assigned owner.

5. Notification

Where we process personal data on your behalf, we act as processor: we notify you, and you, as controller, decide on and make any notification to supervisory authorities and data subjects. For data about you as our customer, such as your account, workspace settings and billing, we are the controller, and we notify the supervisory authority and data subjects directly where the law requires it. Shopify merchants using TruSend are notified as customers.

• Affected customers — without undue delay after becoming aware of the breach, by email to the workspace owners. DPA §4.6; GDPR art. 33(2); Serbian Law on Personal Data Protection art. 52.
• Shopify — immediately, and no later than 24 hours after becoming aware of an actual or suspected breach of data received from Shopify, by email to Shopify Support. We then remedy the breach, investigate it, mitigate further harm and respond promptly to Shopify’s requests for information. Shopify API License and Terms §6.2.10.
• Supervisory authority — where we are the controller, without undue delay and in any event within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (Serbian Law on Personal Data Protection art. 52); in the EU, the supervisory authority of each Member State in which affected individuals reside, which we may notify through our article 27 representative named on the company details page (GDPR art. 33).
• Affected people directly — where we are the controller, without undue delay when the breach is likely to result in a high risk to their rights and freedoms. GDPR art. 34; Serbian Law on Personal Data Protection art. 53.
• Affected subprocessors or partners — where the cause of the incident or its remediation lies with them, through their designated security contact.

Each customer notice describes the nature of the breach and when it occurred; the categories and approximate number of data subjects and personal data records concerned; the likely consequences; the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects; and a contact point for further information at privacy@trusend.ai. Where information is not yet available, the notice states this and when further information is expected; further information is provided in phases as it becomes available.

6. Records and review

Incidents are recorded, including SEV-3 incidents and incidents found not to be personal data breaches. Where we are the controller, this record is the documentation of personal data breaches required by GDPR art. 33(5) and Serbian Law on Personal Data Protection art. 52. Access to incident records is restricted to the incident lead and the technical lead. Each record holds the timeline, the severity, the affected data and customers, the evidence, and the decisions taken with the reasons for them. Incident records are kept for 3 years after closing.

This policy is reviewed every 12 months, after each SEV-1 incident, and whenever the breach notification terms of the DPA or the applicable Shopify terms change.