Security incident response – E-Rechnung Deutschland

1. Scope

This policy describes how aoex handles security incidents affecting the Shopify app E-Rechnung Deutschland. It covers the App, its PostgreSQL database and the stored invoice files. Contact: contact@aoex.be.

2. What counts as a security incident

A security incident is a confirmed or likely unauthorised access to, or loss, alteration or disclosure of, personal data or invoice files, a compromise of credentials, or an attack that makes the App unavailable. A single rejected webhook whose HMAC signature does not match, and which is only logged, is not by itself an incident.

3. Safeguards

• The App, its PostgreSQL database and the KoSIT validator run on Fly.io in the Frankfurt region (fra).
• All connections use HTTPS.
• Shopify webhooks are accepted only after the HMAC signature has been checked and matches.
• Production access is limited to the aoex team members who need it. Those accounts use two-factor authentication.
• Actions on invoices are written to the audit log.

4. What we do

• Detect: server logs, rejected webhooks and reports sent to contact@aoex.be.
• Contain: revoke affected sessions and block the affected access.
• Assess whether personal data or invoice files are affected.
• Notify as described in section 5, and fix the cause.

5. Notice under Art. 33 and 34 GDPR

When aoex becomes aware of a personal-data breach that is likely to result in a risk to the rights and freedoms of natural persons, aoex notifies the competent supervisory authority within 72 hours of becoming aware (Art. 33 GDPR). Where a high risk is likely, aoex informs the affected people within 72 hours of becoming aware (Art. 34 GDPR). Merchants whose shop or customers are affected are informed within the same time. Buyers should contact the Merchant first; aoex assists the Merchant. Questions and reports: contact@aoex.be.

6. Record

aoex records the incident, the measures taken and the notice given. What follows from it is applied in the App.

7. Contact

Security reports and questions: contact@aoex.be.

aoex · contact@aoex.be · https://aoex.be/