Last updated: 21 June 2026
This policy applies to all applications published by Elarix Dev Ltd under the Elarix Apps (ElarixDev) name, including our Shopify apps and other software, together with the websites, databases and file storage that run them. It explains how we prevent, detect, respond to and learn from security incidents that affect the personal data we process on behalf of merchants and their customers.
1. Purpose and scope
The purpose of this policy is to make sure that any event threatening the confidentiality, integrity or availability of the data we handle is identified quickly, contained, resolved and learned from, and that the people affected are told when they need to be. It applies to every Elarix application and the infrastructure that supports it, and to everyone who works on those applications.
2. The data we hold
Each Elarix app processes only the personal data needed for its stated function, as described in that app’s store listing and in our privacy policy. Depending on the app this may include information such as a customer’s name and order details. We apply data minimisation across the whole portfolio and do not collect or retain more personal data than each app requires, which limits the impact of any incident.
3. What counts as a security incident
A security incident is any event that compromises, or could reasonably compromise, the confidentiality, integrity or availability of the data or systems we operate. Examples include unauthorised access to an application, its database or its file storage, loss or theft of credentials, accidental disclosure of personal data, malware, exploitation of a confirmed vulnerability, or a prolonged loss of service. A personal data breach is any incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
4. Severity levels
We classify each incident so that the response matches the risk:
- Low: little or no personal data at risk and easily contained, such as a non-exploitable dependency advisory or a single blocked sign-in attempt.
- Medium: limited exposure or a risk to a small number of records, with no confirmed unauthorised access.
- High: confirmed unauthorised access to systems or to personal data affecting one or more merchants.
- Critical: a large-scale or ongoing breach of personal data, or a sustained loss of a production service.
5. Roles and responsibilities
The Elarix team is responsible for incident response. Morgan Molisho is the incident lead, owns each incident through to closure, and is the point of contact for the platforms we run on and for merchants. In the lead’s absence Moussa Issa acts in their place. Anyone working on an Elarix application is responsible for raising a suspected incident without delay.
6. Detection and reporting
Incidents may come to light through platform and database audit logs, application logs, dependency and vulnerability scanning, automated alerts, a report from a merchant, or a report from the platform on which an app is published, such as Shopify. Any team member who suspects an incident reports it to the incident lead immediately, and the lead takes ownership from that point.
7. Our response process
On becoming aware of an incident we work through the following steps, recording each as we go:
- Identify and triage: confirm what has happened, assign a severity, and decide who needs to be involved.
- Contain: stop the incident spreading by revoking compromised credentials, isolating affected systems and rotating secrets as needed.
- Assess: establish which data, which merchants and which customers are affected, and the level of risk to them.
- Eradicate: remove the cause by patching the vulnerability or closing the unauthorised access.
- Recover: restore service from known-good backups and confirm that the system is healthy and the issue has not recurred.
8. Notification and communication
Where an incident involves personal data, we notify the affected platform promptly, including Shopify in line with its requirements for apps that handle protected customer data. We notify affected merchants without undue delay so that they, as the controllers of their customers’ data, can inform their own customers. Where a personal data breach is likely to result in a risk to people’s rights and freedoms, we notify the UK Information Commissioner’s Office within 72 hours of becoming aware of it, and where the risk is high we assist the merchant in informing the individuals affected.
9. Record keeping
We keep a record of every incident, including what happened, when it was discovered, the data, merchants and customers affected, the severity, the actions taken and the outcome. These records support the post-incident review and allow us to demonstrate how we have met our obligations.
10. Post-incident review
After every incident we review what happened, how we responded, and what we will change to reduce the chance of it happening again, and we put those changes into effect. Higher-severity incidents receive a more thorough review.
11. Preventive measures
We reduce the likelihood and impact of incidents by design. Data is encrypted in transit, and stored on infrastructure that encrypts data at rest. Access to production systems is limited to the two founders and protected by two-step authentication, with credentials held in the hosting provider’s secrets store rather than in the application. We review dependencies for known vulnerabilities before release, keep automated backups, and implement the data deletion and redaction processes that the platforms require, so that personal data can be erased on request.
12. Policy review and testing
We review this policy at least once a year and after any significant incident, and we periodically walk through the response steps so that they are ready to use when needed.
13. Contact
For any question about this policy or to report a security concern, contact Elarix Dev Ltd at info@elarixdev.com.