Security Incident Policy

KID og EHF · Last updated 14 October 2026

This policy describes how KID og EHF detects, contains, reports and learns from security incidents, including personal data breaches under the GDPR (articles 33 and 34). It applies to the app, its database and hosting, its source code, and every account used to operate them.

1. Responsibility and contact

The service provider is responsible for this policy and acts as incident lead. Report a suspected incident at any time to:

2. What counts as an incident

• Unauthorised access to, or disclosure, alteration, loss or destruction of, merchant or customer data.
• Compromise or suspected compromise of credentials: Shopify Partner account, hosting account, database password, app secrets or source code repository.
• Unexpected entries in the app’s access log, hosting logs or Shopify notifications indicating misuse.
• Loss of availability that prevents invoices from being created or retrieved for an extended period.

3. Detection

• Every view, creation, download and transmission of invoices containing customer data is recorded in an access log (Shopify staff ID, action, invoice number and time – no names or email addresses). Merchants can see their own log in the app under Tilgangslogg. Entries are kept for 365 days.
• Hosting and application logs, and security notices from Shopify, the hosting provider and the code repository, are reviewed when received.
• Anyone may report a suspected incident to the contact above.

4. Response steps

1. Record the report immediately in the incident register with date, time and source.
2. Contain: revoke or rotate affected credentials (database password, app secret, access tokens), disable affected services or access, and preserve logs as evidence.
3. Assess which shops, which data and roughly how many people are affected, and the likely risk to them.
4. Notify as described in section 5.
5. Recover: restore from backup if data was lost or altered, and verify that the system is clean before re-enabling it.
6. Review: within 14 days, document the cause and the measures taken to prevent it happening again.

5. Notification

• Merchants (data controllers) whose data is affected are notified without undue delay and no later than 48 hours after we become aware of a personal data breach, by email to the shop’s contact address. The notice describes what happened, the data and approximate number of people concerned, likely consequences, measures taken, and a contact point – so that the merchant can meet its own duty to notify its supervisory authority within 72 hours.
• Shopify is notified without undue delay where the incident involves data obtained through Shopify’s APIs, in line with Shopify’s partner terms.
• Where we act as controller for our own data (for example merchant contact details), we notify the competent supervisory authority within 72 hours unless the breach is unlikely to result in a risk to people, and inform the people concerned directly when the risk is high.
• If not all information is available within these deadlines, an initial notice is sent and completed as facts become known.

6. Documentation

Every incident and personal data breach is recorded in an incident register, whether or not it is notified, including the facts, its effects and the remedial action taken (GDPR article 33(5)). The register is kept for at least five years and is made available to merchants and supervisory authorities on request.

7. Prevention

• HTTPS for all app traffic; TLS required for the database connection; encryption at rest by the hosting provider.
• Separate test and production environments; production data is never used for testing.
• Unique, strong passwords and two-factor authentication on every account used to operate the service.
• Access to production data limited to the service provider.
• Automated backups of the production database.
• This policy is reviewed at least once a year and after every significant incident.