Information Security Policy

1. Scope and ownership

This policy applies to Dual Heritage and all other brands operated by Laelaps LLC, and covers every system that stores or processes customer, order, or partner data, including data received from marketplace and sales-channel integrations (such as TikTok Shop). The owner of Laelaps LLC is responsible for this policy and for making sure it is followed in day-to-day operations.

2. Data we handle and data minimization

We collect only the data needed to take, produce, and deliver orders: customer name, email, delivery address, order contents, and order status. We do not store payment card numbers. Data received from partner platforms is used only to fulfill and support those orders, and is never sold or used for unrelated marketing.

3. Data classification and encryption

We classify data into three levels and protect each accordingly:

• Confidential: customer personal data (names, emails, delivery addresses), order records, data received from partner platforms, and all credentials, API keys, and access tokens. Restricted to authorized personnel and systems on a least-privilege basis, encrypted in transit and at rest, and never stored in source code, client-side code, logs, or personal devices.
• Internal: business records such as sales figures, supplier details, and product files. Limited to company personnel and stored only in access-controlled business accounts.
• Public: product listings, prices, images, and website content. Can be shared freely.

All data is encrypted in transit using TLS (HTTPS only), including traffic between our servers and our providers. Data is encrypted at rest (AES-256) by our hosting, database, and storage providers. Payment card data is never stored by us; it is handled entirely by our payment processor.

4. Payments

All card and wallet payments are processed by Stripe, a PCI DSS Level 1 certified payment provider. Card details are entered directly into Stripe-hosted fields and never reach or are stored on our servers.

5. Access control

• Access to production systems, databases, and partner accounts is limited to authorized personnel only, on a need-to-know basis.
• Multi-factor authentication is required on all administrative accounts (hosting, database, payments, email, and sales-channel accounts).
• API keys are issued with the least privilege needed (for example, restricted payment keys limited to the specific operations our systems perform).
• Access is removed immediately when it is no longer needed.

6. Workstation and device security

• Devices used for company work run up-to-date antivirus with real-time protection (Microsoft Defender) and install operating-system security updates automatically.
• Devices lock automatically after 5 minutes of inactivity and require a password, PIN, or biometric to unlock.
• Every account uses a unique, complex password stored in a password manager.
• We follow a clear-desk and clear-screen practice: customer data is not printed or left visible, and credentials are never written down or shared.

7. Credentials and secrets

• API keys, app secrets, and access tokens are stored only as encrypted environment variables or in access-restricted server-side storage, never in source code or client-side code.
• Partner OAuth access tokens are kept server-side and refreshed automatically before they expire.
• Any credential suspected of exposure is rotated promptly.

8. Infrastructure and data protection

• All website and API traffic is served over HTTPS (TLS); unencrypted connections are not accepted.
• Data is hosted with established cloud providers that encrypt data at rest.
• Database tables are protected with row-level security, so data is only reachable through our authenticated server code.
• Incoming webhooks from payment and sales-channel partners are verified by cryptographic signature before they are processed; unsigned or invalid requests are rejected.

9. Third-party processors

We share data only with the service providers needed to operate: our payment processor, hosting and database providers, email delivery service, and fulfillment partners (who receive delivery details solely to produce and ship orders). We use reputable providers that maintain their own security programs.

10. Data retention and deletion

Order records are kept for up to 2 years for accounting and customer service, then deleted. Customers can request access to or deletion of their data at any time by emailing support@dualheritage.com. Data received from a partner platform is deleted when that integration ends or when the partner's terms require.

11. Vulnerability and threat management

• Dependency scanning: our source code repository is scanned automatically for known vulnerabilities in third-party libraries, and security updates are proposed automatically as they are published.
• Patching timelines: critical and high-severity vulnerabilities are patched within 7 days of a fix becoming available, and moderate and low-severity issues in our regular monthly update cycle.
• Managed infrastructure: servers, operating systems, and databases are run and patched by our hosting and database providers, and our website traffic is protected by our hosting provider's firewall and DDoS mitigation.
• Threat intelligence: we monitor security advisories from our providers and libraries, and act on any notice affecting our systems.
• Secure changes: every code change is type-checked and built before it is deployed, and deployments can be rolled back instantly.
• Endpoints: company devices receive automatic operating-system and antivirus updates (see Workstation and device security).
• External reports: vulnerabilities reported to us (see Reporting a security issue) are assessed and fixed on the same timelines.

12. Monitoring and incident response

Roles and responsibilities. The owner of Laelaps LLC is the Incident Response Lead and is responsible for detecting, assessing, containing, and resolving security incidents, and for all internal and external communication about them. Our service providers (hosting, database, payments, and fulfillment) are responsible for incidents within their own infrastructure and notify us through their security notification channels; the Incident Response Lead coordinates our response to any such notice.

Detection and reporting channels. Application errors and failed payment or checkout events generate automatic alerts to the Incident Response Lead. Anyone (customers, partners, providers, or security researchers) can report a suspected incident or vulnerability by emailing support@dualheritage.com, which is monitored daily.

Response process.

• Assess: confirm the incident, its scope, and what data or systems are affected.
• Contain: revoke and rotate affected credentials and tokens, disable affected integrations or accounts, and block malicious access.
• Resolve: fix the root cause and restore normal operation.
• Review: document the incident and its cause, and update this policy and our controls to prevent recurrence.

Communication. Affected customers are notified by email, and affected partner platforms (such as TikTok Shop) are notified through their designated partner or security contact channels, without undue delay and within 72 hours of confirming a breach that affects their data. Where required by law, we also notify the relevant authorities, such as the UK Information Commissioner's Office or applicable US state authorities.

13. Policy review

This policy is reviewed at least every six months, and whenever we add a new system, integration, or data-processing partner, to make sure the security measures described here remain accurate and enforced.

14. Reporting a security issue

If you believe you have found a security vulnerability or that data has been exposed, please email support@dualheritage.com. We will acknowledge your report and investigate promptly.