Security & Incident Response

Last updated: 21 October 2026

How we protect data

Encryption: all traffic uses HTTPS/TLS. Access tokens for Shopify, Meta, WhatsApp, couriers and other platforms are encrypted (AES-256-GCM) before they are stored.
Access control: sign-in with Google; every merchant's data is separated; team roles (Owner, Manager, Analyst, Viewer) limit what each person can do.
Least privilege: we ask platforms only for the permissions a feature needs. Actions that change ads or send messages follow the merchant's approval settings.
Audit trail: every important action — by people, the AI agent or our team — is recorded with who, what and when.
Our team: multi-factor authentication on all admin accounts (hosting, database, code, email, platform developer accounts); strong unique passwords; access removed when no longer needed.
Infrastructure: managed cloud hosting and database with automatic backups and point-in-time recovery; secrets kept in the hosting provider's encrypted settings, never in code.
Webhooks: incoming platform callbacks are verified with signatures or secret tokens.

Detect & report: alerts from monitoring, platform notices or reports from anyone to telewebads@gmail.com.
Contain (within hours): revoke affected tokens and sessions, rotate keys, block the source, pause affected automations.
Assess: find what data and which merchants were affected, how, and since when, using audit and access logs.
Notify: affected merchants without undue delay (target 24 hours); help them inform the Data Protection Board of India and affected people as the DPDP Act requires; CERT-In within 6 hours for reportable incidents; platforms (Meta, Shopify, Google, Amazon) as their terms require.
Recover: restore from clean backups, verify, re-enable services.
Learn: written review within 7 days and fixes to prevent a repeat.

Write to telewebads@gmail.com with “Security” in the subject. We acknowledge within 24 hours. Please don't access other people's data while testing.