Effective October 27, 2026. This policy describes how Axeclusive Solutions protects data and what happens if something goes wrong. It is Annex 2 (technical and organisational measures) of our Data Processing Addendum.
1. Security measures
- Encryption in transit: all pages and APIs are served over HTTPS (TLS).
- Passwords: stored only as salted one-way hashes; common passwords are refused; sign-in attempts are rate-limited; sessions can be revoked on all devices.
- Two-step sign-in: administrator and business-owner accounts can be required to enter a one-time code texted to a verified phone; codes are short-lived, rate-limited and stored only as keyed hashes; one-use backup codes are hashed; phone numbers are stored encrypted.
- File uploads: customer imports accept only text, vCard and Excel files, which are checked for programs, macros, scripts, disguised archives, XML and spreadsheet-formula attacks and known malware signatures before anything is read; refused files are deleted and logged; accepted files are kept encrypted until imported.
- Payment cards: card numbers are entered on the payment provider’s hosted page or secure field and never touch our servers (PCI DSS SAQ-A scope). Payment-provider secret keys are stored encrypted.
- Tenant isolation: every query is scoped to the business that owns the data; access to another business’s data is denied by default.
- Access control: role-based permissions with “deny by default”, per-location access, and the option to limit what each staff member sees.
- Application security: protection against cross-site request forgery, cross-site scripting, SQL injection and open redirects; the website-scanning feature blocks private network addresses (SSRF protection).
- Audit logs: sign-ins, team changes and every platform-administrator action on a business account (including opening its dashboard) are logged.
- Backups: regular backups by our hosting provider, plus built-in exports so businesses can keep their own copies.
- Data minimisation and retention: logs and unfinished drafts are deleted automatically after set periods; businesses can export and erase individual customers’ data.
- People: access to production systems is limited to authorised personnel who need it and are bound by confidentiality.
2. Shared responsibility
Each business is responsible for its users’ passwords and devices, for giving staff only the access they need, for removing former staff, for the data it chooses to collect, and for the security of the websites and accounts it connects (for example its own Stripe, Square or PayPal account).
3. Incident response
- Detect and record. Every suspected incident is recorded in our incident register with the time it was discovered.
- Contain. We act to stop the incident (for example revoking sessions, rotating keys, blocking access or taking systems offline).
- Assess. We assess what data and which businesses are affected and whether there is a real risk of significant harm.
- Notify businesses. Affected businesses (the controllers) are notified without undue delay, and where feasible within 48 hours, with what we know and what they should do.
- Notify authorities and individuals. Where we are the controller, we notify the competent supervisory authority within 72 hours under the GDPR/UK GDPR where required, the Office of the Privacy Commissioner of Canada and affected individuals “as soon as feasible” under PIPEDA where there is a real risk of significant harm, the Commission d’accès à l’information under Quebec Law 25, and US state authorities and individuals as each state’s breach law requires.
- Learn. We review the cause and improve our controls. Breach records are kept for at least 24 months.
Notifying a business or authority about an incident is not an admission of fault or liability.
4. Reporting a vulnerability
Please report security issues to [Legal / privacy e-mail] with enough detail to reproduce them. Do not access other businesses’ data, disrupt the Service or publicly disclose the issue before we have had a reasonable time to fix it. We will not take legal action against good-faith research that follows these rules.