Security Incident Response

1. Scope

This policy covers security incidents affecting Cuanto Labs LLC ("Cuanto Labs," "we") systems and the data they hold, including the SayMaya Shopify app, its AI assistant, our self-hosted support inbox, and the merchant and shopper data they process. An incident is any confirmed or reasonably suspected unauthorized access to, or loss, change or disclosure of, that data, or any event that takes these systems offline in a way that puts data at risk.

2. Roles

• Incident lead: Eliran Yihye, founder of Cuanto Labs. Owns every incident from first report to post-mortem, decides on containment, and sends all notifications.
• Reporting contact: hello@cuantolabs.com. Anyone (merchants, shoppers, researchers, service providers) can report a suspected incident or vulnerability there. Reports are read daily.
• Service providers: hosting and AI providers listed in the SayMaya Privacy Policy report incidents on their side to us under their contracts; we treat those reports as incidents under this policy.

3. How We Run

Production runs on Amazon Web Services (Lightsail) in the United States. Servers accept no direct inbound traffic: public access goes through a Cloudflare tunnel, and staff reach servers only over a private, access-controlled network. Secrets (API keys, database passwords, Shopify credentials) are held in an encrypted vault and loaded at deploy time, never stored in source code. Access to production is limited to Cuanto Labs staff who need it.

4. Detection

• Automated health checks on every service, with alerts to the incident lead.
• An append-only access log of every read of customer and order data (who or what read it, when, and the result), kept for one year and protected against edits.
• Service and error logs, reviewed when alerts fire and during routine checks.
• Reports sent to hello@cuantolabs.com and notices from Shopify or our service providers.

5. Containment

Once an incident is confirmed or reasonably suspected, we act first to stop further exposure. Depending on the incident, that means:

• Rotating affected credentials and secrets, including Shopify access tokens and API keys.
• Turning off the affected feature (for example, order lookups or the AI assistant) or taking the affected service offline.
• Blocking the access path used (accounts, network routes, keys) and preserving logs and evidence for the investigation.
• Restoring from known-good backups where data was changed or lost.

6. Notification

We notify affected merchants and Shopify without undue delay, and no later than 72 hours after we become aware of an incident affecting merchant or shopper personal data. The notice says what happened, what data is involved, what we have done, and what the merchant should do. We follow up as we learn more. Where the law requires it, we also notify regulators and help merchants notify their affected shoppers. Merchants are notified by email at their store owner address; Shopify through its Partner support channel.

7. Recovery and Post-Mortem

After containment we fix the root cause, confirm the fix, and restore normal service. Within 14 days of closing an incident we write a post-mortem: timeline, root cause, data affected, what worked, what did not, and the changes we will make. Those changes are tracked to completion, and this policy is updated when they change how we respond. Affected merchants can request a summary of the post-mortem at hello@cuantolabs.com.

8. Review

We review this policy at least once a year and after every incident.

9. Contact