Purpose: reduce the risk that protected customer data leaves authorised systems used for Cosmetic Wholesale Sync. Related: privacy appendix, DPA, incident response.
1. Technical controls
- Secrets only in Kubernetes Secrets / environment variables — never in client JavaScript or the public docs repository
- Separate staging vs public App Store databases
- HTTPS only for store-platform and Cosmetic Wholesale APIs
- Order personal data held in the order-push queue; shipping contact cleared on successful delivery; remaining contact blanked by the retention job (
CW_PII_RETENTION_DAYS, default 90). Order reference stays. PiiAccessLogrecords enqueue, delivery read, redact, data request, merchant “Show data”, and purge. The retention job does not delete those log rows.
2. Organisational controls
- Production access limited to engineering and support roles with bastion / strong auth
- No production dumps to laptops without approval and scrubbing
- Public repositories must not contain credentials or live catalogue tokens
3. Detection and response
Suspected exfiltration or misconfiguration is handled under the security incident response process.
4. Contact
This page is not a substitute for enterprise DLP products or independent legal advice.