Avenor

Security Incident Response Policy

Last updated 1 November 2026.

This one-page policy describes how Avenor handles a security incident that may affect ProofPop - Sales Popup & Proof, merchant shop data, or limited shopper fields we store for sales popups (first name, last initial, city, and country).

1. What counts as an incident

We treat any of the following as a security incident:

• Unauthorized access to our systems, databases, or app credentials.
• Loss, theft, or exposure of personal data we store for a shop.
• A confirmed vulnerability that can be used to read or change another shop’s data.
• Malware, ransomware, or a serious hosting/provider breach that affects ProofPop.

2. Who is responsible

The Avenor engineering lead owns incident response. That person (or their backup) triages reports, decides severity, coordinates the fix, and decides who must be notified.

3. How to report

Merchants: use Help in the ProofPop - Sales Popup & Proof admin, or Contact on this site. Mark the message as a security concern when you can.

Researchers and partners: use the same Contact channel and include enough detail to reproduce the issue. Please do not publicly disclose a vulnerability until we have had a reasonable chance to fix it.

4. Response steps

1. Acknowledge — we aim to acknowledge a credible report within 1 business day.
2. Contain — revoke or rotate exposed secrets, block abusive traffic, take affected services offline if needed, and stop further data exposure.
3. Investigate — determine what systems and shops were affected, what data was involved, and the timeline.
4. Remediate — patch the cause, restore services safely, and verify the fix.
5. Notify — if personal data or merchant accounts were likely affected, we notify impacted merchants promptly and, where required, Shopify and relevant authorities. Notices explain what happened, what data was involved (if known), and what we recommend next.
6. Review — after the incident is closed, we record what went wrong and what we will change to reduce the chance it happens again.

5. Severity guide

• Critical — active breach or confirmed cross-shop data access. Drop other work; contain immediately.
• High — credible exploit path or limited unauthorized access. Fix and notify as needed within days, not weeks.
• Medium / Low — hardening issues or unverified reports. Scheduled fix with tracking.

6. Data we protect under this policy

Shop domain and settings; owner contact email used for install/uninstall mail; billing status from Shopify; dashboard event stats; and, when used in sales popup headings, shopper first name, last initial, city, and country. We do not store shopper email, phone, or street address for popups. See the Privacy Policy for full detail.

7. Changes

If this policy changes, we update the date at the top of this page.

8. Contact

Avenor
ProofPop - Sales Popup & Proof
Contact · Help in the app admin