Security Policy

1. Infrastructure

KLYX OmniChat runs on a Dokploy-managed VPS infrastructure hosted in the EU. The following controls are in place at the infrastructure level:

• All services are containerized via Docker for process isolation
• The VPS is protected by a firewall that allows only necessary inbound ports (HTTPS/443, SSH with key authentication)
• SSH password authentication is disabled; only pre-approved public key pairs are accepted
• Operating system security patches are applied on a regular schedule
• All traffic to and from the app is served over HTTPS (TLS 1.2+) with HSTS enabled

2. Data Encryption

OAuth tokens for Shopify, Instagram, and WhatsApp are additionally encrypted at the application layer before being written to the database. Raw tokens are never logged.

3. API & Token Security

We follow least-privilege principles for all API integrations:

Shopify: The App requests only the OAuth scopes required for its features (product read, order read, customer read for opted-in customers). Scopes are not expanded beyond what is listed in the App's Shopify Partner configuration.

Instagram / Meta: Only the permissions required for DM management, comment handling, and feed read are requested. The App does not request ad management or account-level permissions.

WhatsApp Business API: Access is scoped to the specific phone number ID registered by the merchant. The App cannot access other numbers under the Meta Business account.

Access tokens are rotated automatically when Shopify or Meta issues a new token via their standard refresh flows. Expired tokens are deleted, not archived.

4. Access Control

Access to production systems is strictly controlled:

• Only authorized KLYX engineers have SSH access to the VPS, via individually assigned key pairs
• Database access is not exposed to the public internet; it is accessible only from within the private network of the VPS
• Dokploy dashboard access uses strong passwords and 2FA
• No customer data is accessible to KLYX staff except when required to diagnose a reported issue, and only after internal authorization
• Access logs are maintained for all administrative actions on production systems

Multi-store isolation is enforced at the application layer — each Shopify merchant's data is scoped to their shop domain and cannot be accessed by other merchants.

5. Webhook Verification

All inbound webhooks are cryptographically verified before processing:

• Shopify webhooks: Verified using HMAC-SHA256 signatures against the App's client secret. Webhooks without a valid signature are rejected with a 401 response.
• Meta webhooks (Instagram & WhatsApp): Verified using the X-Hub-Signature-256 header against the App's Meta webhook secret. Invalid signatures result in silent rejection (200 response to prevent retries, no processing).

Webhook payloads are processed in isolated handlers. Errors in one handler do not affect other webhooks.

6. Monitoring & Logging

We maintain the following monitoring and logging practices:

• Application logs are collected via Dokploy and retained for 30 days
• Error tracking is in place for application exceptions
• API rate limit errors and authentication failures are logged and alerted on
• Unusual access patterns (e.g., abnormally high message volumes, repeated auth failures) trigger automated alerts
• Logs never contain OAuth tokens, API keys, customer passwords, or payment information

7. Backups

Automated database backups run daily. Backups are:

• Encrypted at rest before storage
• Retained for 14 days
• Tested for restorability on a regular basis
• Stored separately from the primary VPS

In the event of data loss or corruption, we can restore the database to any point within the 14-day backup window.

8. Incident Response

In the event of a confirmed security incident involving merchant or customer data, KLYX will:

• Within 24 hours: Contain the incident and assess the scope of any data exposure
• Within 48 hours: Notify affected merchants via email to their Shopify account address
• Within 72 hours: If required by GDPR or other applicable law, notify the relevant supervisory authority
• Within 7 days: Publish a post-incident summary describing what happened, what data was affected, and what measures were taken

9. Responsible Disclosure

We welcome reports from security researchers. If you discover a vulnerability in KLYX OmniChat:

• Report it to contact@klyx.agency before public disclosure
• Include a clear description of the vulnerability, steps to reproduce, and potential impact
• Do not exploit the vulnerability beyond what is necessary to demonstrate it
• Do not access, modify, or delete data belonging to other merchants or customers

We will acknowledge your report within 48 hours, work to resolve confirmed vulnerabilities promptly, and credit you in our security acknowledgements (unless you prefer anonymity).

10. Security Contact

For security-related questions, vulnerability reports, or incident notifications:

• Email: contact@klyx.agency
• Subject line: "[OmniChat Security]" for fastest routing
• Response time: Within 48 hours for security reports