Security and incident response

Version 2026-10-26. How we protect the data merchants entrust to DeliverAI and what we do if something goes wrong. DeliverAI is operated by Prime Sales Ltd.

How data is protected

• Hosted on Amazon Web Services in the EU (Stockholm); encrypted at rest and in transit (TLS).
• Phone numbers are stored as a one-way hash for matching and encrypted when kept for audit.
• Backups with point-in-time recovery (35 days), encrypted.
• Production and test environments are separate: testing never uses production data.
• Only staff who need it have access, all with two-factor authentication. Every view of customer data in the dashboard is logged and the log is kept 12 months.
• Retention: order data 24 months after last activity, call recordings 90 days, everything for a store 48 hours after it uninstalls the app.

If there is a security incident

1. Contain within 4 hours of discovery: revoke and rotate credentials, stop processing if needed.
2. Assess within 24 hours: what data, which stores, since when — using our access and system logs.
3. Notify affected merchants without undue delay and no later than 72 hours after we become aware, with what you need for your own notifications; and notify Shopify.
4. Recover and review: restore from backups if needed and fix the root cause within 14 days.

Report a vulnerability

Email b.yordanov@inaessentials.com. We reply within 2 working days.