Security Incident Response Policy

This policy describes how UnReturns (operated by Alforeo) responds to security incidents involving personal data processed on behalf of merchants.

1. Scope

A security incident is any unauthorized access, disclosure, loss, or alteration of personal data processed by UnReturns.

2. Detection

We monitor application logs and alerts from our infrastructure providers (Vercel, Supabase) for unauthorized access or unusual activity.

3. Containment

On discovering an incident, we act immediately to contain it — revoking compromised credentials, rotating API keys and access tokens, and restricting access to affected systems.

4. Assessment

We determine what data was affected, which merchants and customers are impacted, and the cause.

5. Notification

We notify affected merchants without undue delay and within 72 hours of becoming aware of a personal data breach, and notify Shopify as required. Where legally required, we assist merchants in notifying affected individuals and regulators.

6. Remediation

We fix the root cause, restore from secure backups if needed, and document the incident and the steps taken to prevent recurrence.

7. Contact

Report security concerns to: support@alforeo.com