Security Incident Response Policy: Bulkora
Effective: 30 October 2026 · Next review: October 2027
Owner: Metafoid, for the Shopify app Bulkora: Import Export & Edit. Contact: support@metafoid.com
1. Scope
This policy covers Bulkora: its application (hosted on Fly.io in production), its Neon Postgres database, its job files and Logs, its GDPR compliance webhooks, its scheduled cleanup job, and every credential used to run them. It applies to any incident affecting the confidentiality, integrity or availability of merchant data, or of the Shopify customer and order personal data that merchants export, import or bulk edit with the app.
2. Roles
- Incident Lead (Metafoid): owns detection, triage, decisions, communication and the post-incident review.
- Sub-processors: Shopify, Fly.io and Neon, each contacted through their official support channels as needed.
3. Detection
Incidents may be found through hosting and database logs, application error monitoring, unusual activity in the in-app Logs, alerts from providers (Shopify, Fly.io, Neon, GitHub), or reports from merchants, Shopify or security researchers sent to support@metafoid.com. Every report is acknowledged within 1 business day.
4. Severity levels
| Level | Description | Initial response |
|---|---|---|
| Critical | Confirmed unauthorized access to, or theft of, personal data; leaked production secrets | Immediately, within 4 hours |
| High | Likely exposure of personal data or credentials; production outage | Within 24 hours |
| Medium | Vulnerability with no evidence of exploitation | Within 3 business days |
| Low | Minor issue with no data impact | Next scheduled maintenance |
5. Containment
Isolate the affected component: scale down or block the affected service, revoke compromised sessions and tokens, restrict database access, disable affected features or webhooks, and preserve logs and evidence before making changes.
6. Credential rotation
When compromise is suspected, rotate immediately:
- Shopify API secret: regenerate the client secret in the Shopify Dev Dashboard and update the hosting secrets. Merchant access tokens are invalidated or refreshed as needed.
- Database: reset the Neon role password or connection string and update the app's environment.
- Other secrets: rotate the session secret, the cron secret and any other affected API keys, then confirm the old credentials no longer work.
7. Notification
- Affected merchants and Shopify are notified without undue delay, and no later than 72 hours after an incident involving personal data is confirmed. The notice says what happened, which data was affected, what we did and what we recommend.
- Data protection authorities: where GDPR Article 33 or another data protection law requires it, the breach is reported to the competent authority within 72 hours of becoming aware of it. Metafoid usually acts as a processor for merchants, so it also helps merchants, as controllers, meet their own duties to notify authorities and affected people (Article 34).
- Every incident is recorded in an internal breach register, whether or not it is notified.
8. Recovery
Fix the root cause, restore affected data from Neon backups or point-in-time recovery if needed, redeploy from a verified commit, check data integrity and app behavior, and monitor closely after restoration.
9. Post-incident review
Within 14 days of resolving a High or Critical incident, we document the timeline, root cause, impact and corrective actions, and track those actions until they are complete.
10. Annual review
This policy is reviewed at least once a year, and after any significant incident or change to the app's infrastructure.
Metafoid holds no third-party security certifications. This policy describes our internal practices.