Security Policy

• Seller passwords are hashed with bcrypt; we never store or transmit them in plain text.
• Sessions use signed, HTTP-only cookies with a 30-day maximum lifetime.
• Marketplace connections use OAuth 2.0 with PKCE — we never ask for or receive your marketplace password.
• Role-based access separates seller accounts from platform administration.

• Access and refresh tokens are encrypted at rest and are never returned by our API or shown in the interface.
• Tokens are scoped to the minimum permissions each integration needs.
• Disconnecting a shop deletes its tokens immediately and irreversibly.
• Refresh happens server-side only; tokens never reach the browser.

• All traffic is served over TLS 1.2 or higher with HSTS.
• Databases are encrypted at rest with provider-managed keys and backed up daily.
• Backups are encrypted and retained for 30 days.
• Production data is never copied into development environments.

• All database access goes through a parameterized ORM layer, preventing SQL injection.
• Server-rendered output is escaped by default to prevent cross-site scripting.
• State-changing requests are protected against CSRF by same-site cookies and server actions.
• Dependencies are monitored for known vulnerabilities and patched on a regular cadence.
• Rate limiting is applied to authentication and API endpoints.

• Access to production is restricted to named engineers with multi-factor authentication.
• Every administrative action is written to an immutable audit log.
• Infrastructure changes go through peer review before deployment.
• Monitoring and alerting cover sync failures, error rates and unusual access patterns.

If we detect a breach affecting personal data we will investigate immediately, contain the issue, and notify affected customers and the relevant supervisory authority within 72 hours of becoming aware, including what happened, what data was involved and what we are doing about it.

Please report suspected vulnerabilities to support@dkh.io.vn. Include steps to reproduce and any proof-of-concept. We acknowledge reports within two business days and aim to remediate critical issues within seven days.

We ask researchers not to access data belonging to other users, not to degrade the service, and to give us reasonable time to fix an issue before disclosing it publicly. We will not pursue legal action against researchers who follow these guidelines.

Our integrations use official, documented APIs only. We honour each marketplace's rate limits, data retention requirements and prohibitions on reselling or repurposing buyer data. Where a marketplace requires deletion of buyer data after a set period, we apply that period automatically.