Security and Incident Response

1. Security measures

• Encryption of data in transit (HTTPS/TLS)
• Encryption at rest (AES-256) of the database, provided by Supabase; database hosted in the European Union (Ireland)
• Daily encrypted backups, kept for 7 days
• Data isolation per merchant (Row Level Security)
• Access to production data restricted to authorised personnel
• Logging of access to personal data
• Hashed passwords; payments processed by Stripe (PCI DSS certified), with no card data stored by Goodly

2. Incident response procedure

Step 1 — Detection

An incident may be detected through alerts from our hosting providers (Vercel, Supabase), Goodly's internal security monitor, or a report. Anyone can report a vulnerability or incident to contact@goodly.be.

Step 2 — Containment (under 4 hours)

Within 4 hours of detection, Goodly contains the incident: revocation and rotation of the secrets involved (keys, tokens), blocking of suspicious access.

Step 3 — Assessment

Goodly determines the data affected, the people concerned (merchants, end customers, staff) and the level of risk to their rights and freedoms.

Step 4 — Notification (under 72 hours)

• The merchants concerned are notified within 72 hours of discovery, with the information available
• Shopify is informed when data from the Shopify app is involved
• The Belgian Data Protection Authority is notified where the regulation requires it

Step 5 — Remediation and post-mortem

The cause is fixed, then the incident is analysed (timeline, cause, data concerned, measures taken) and recorded in Goodly's incident register.

3. Roles

For end customers' data, the merchant is the controller and Goodly the processor: it is for the merchant, where applicable, to inform its customers; Goodly assists. See the data processing agreement.

4. Contact

To report an incident or a vulnerability: contact@goodly.be