Security overview

Vatuno · Last updated: 31 August 2026

Data we hold

Buyer name, billing address, VAT identification number where supplied, order identifiers and amounts, and generated invoice PDFs. We do not hold customer email addresses, phone numbers, payment card data or passwords.

Encryption

• In transit: all traffic is served over TLS. Calls to Shopify, VIES and the ECB are HTTPS-only.
• At rest: all stored data — the database, its volume and any volume backups — is encrypted with AES-256 by the hosting provider (Railway). Railway publishes this control in its Trust Center and holds a SOC 2 Type II report. Encryption keys are managed by the provider; customer-managed keys are not used.

Access control

• Access to production data is limited to the app operator; there are no shared accounts.
• Administrative access requires multi-factor authentication on the hosting and Shopify accounts.
• API secrets are held only as environment variables in the hosting platform and are never committed to source control.

Separation of test and production data

Production customer data is never copied into development or test environments. Automated tests run entirely against synthetic fixtures. Where a verification step must write to the live database it uses clearly-marked synthetic records, which are deleted immediately afterwards.

Logging

Every VAT-number validation is logged with its result and timestamp, as evidence of due diligence. Application and request logs are retained by the hosting platform. Logs do not contain payment data or credentials.

Backups

The production database runs on a persistent volume. Volume backups are encrypted at rest with AES-256, the same standard as the primary database, and can only be restored into the same project and environment.

Data loss prevention

Tax records are append-oriented: order records are upserted rather than overwritten destructively, and invoice numbers are allocated under a database uniqueness constraint so a gap or duplicate cannot occur silently. Plan limits never cause a record to be dropped — when a limit is exceeded, data continues to be recorded in full and only report downloads are restricted.

Security incident response

1. Detect and contain — rotate affected credentials immediately and restrict access.
2. Assess — determine which merchants and which categories of personal data are affected.
3. Notify — inform affected merchants without undue delay and within 48 hours of becoming aware, with the facts needed for their own GDPR notification duties.
4. Remediate — fix the root cause, verify, and record the incident and its resolution.

Report a suspected vulnerability or incident: busseozgenoglu@gmail.com.

Privacy policy · Data Processing Agreement