Skip to main content

Data Security Policy

The purpose of this document is to define the LitCommerce Data Security Policy.

Data is considered as a primary asset and must be protected in a manner commensurate to its value. Data security is necessary in today’s environment because data processing represents a concentration on valuable assets in the form of information, equipment, and personnel. The main objective of this policy is to ensure that data is protected in all of its forms, on all media, and during all phases of its life cycle.

Server security

The LitCommerce platform and its data are hosted on secure servers located in the USA, hosted by Linode (Akamai). Our team in Vietnam accesses these systems remotely for operations and support. Data is not stored locally in Vietnam (see GDPR Compliance – International data transfers). Linode employs robust security measures, including:

  • 24/7 surveillance to monitor access to facilities
  • Restricted access to control terminals, allowed only for authorized personnel
  • Network firewalls for enhanced security
  • DDoS protection to prevent distributed denial-of-service attacks

Cloudflare Protection

We leverage Cloudflare for additional protection, including DDoS mitigation, network firewalls, and web traffic monitoring. Cloudflare enhances the security of our infrastructure, ensuring fast and secure access to our services while protecting against potential online threats.

Encryption Methods

We utilize AES-256 encryption to secure data at rest and TLS (Transport Layer Security) to protect data during transmission. This ensures that all sensitive information, including Personally Identifiable Information (PII), is encrypted both in storage and while being transmitted across networks.

Data Retention

We retain your personal data for 90 days after your subscription expires, provided you do not log in again during that period. After that, the data is permanently deleted and cannot be recovered.

Data Access Control

Access to sensitive information is controlled through Role-Based Access Control (RBAC). Only authorized personnel with specific job roles have access to PII. Access is regularly reviewed and restricted to employees on a need-to-know basis, ensuring that data is protected from unauthorized access.

Only authorized LitCommerce engineers can access the source code, handle custom requests and work on support cases on demand of customers. Each of them has their own credentials and can reach certain areas of software only from specific IPs.

Incident Response Plan

LitCommerce has an Incident Response Plan to detect, respond, and mitigate potential security incidents, including unauthorized access or data breaches. Our team acts swiftly to contain and resolve issues, and we maintain transparency with affected stakeholders. In the event of a breach involving third-party data, such as Amazon Information, we promptly notify the relevant parties, including Amazon, to ensure timely communication and resolution.

Monitoring and Auditing

We continuously monitor access to sensitive information, maintaining audit logs to track all data access attempts. Regular reviews ensure that any unauthorized or suspicious activity is detected and responded to promptly.

Device Control

Data Loss Prevention (DLP) tools are in place to prevent unauthorized data transfers to personal devices. Employees are only allowed access to sensitive data through company-managed and secured devices, and any breach attempts trigger real-time alerts for further investigation.

GDPR compliance

LitCommerce complies with the General Data Protection Regulation (GDPR) by ensuring lawful data collection, processing, and storage. We obtain clear consent before collecting personal data, and users have the right to access, rectify, or request deletion of their data at any time. In the event of a data breach, we promptly notify affected users in accordance with GDPR guidelines. Additionally, we ensure that data processing is transparent, and users can contact our Data Protection Officer (DPO) for any inquiries.

Third-party Data Sharing

LitCommerce does not share sensitive customer information with third-party service providers or entities, except where required for legal or operational purposes. All data sharing is conducted in strict compliance with our privacy and security policies.

Payment security

LitCommerce is using PayPal – the No.1 worldwide payment gateway. All your payment data is processed via PayPal, LitCommerce will not store any payment data of our customers.