Security Incident Policy
Last updated: October 13, 2026
Quick Summary
Affected merchants are told within 72 hours
Exposed keys and sessions are revoked first
One named security lead owns every incident
Every incident gets a written review
What counts as a security incident
Any event where merchant or customer data handled by ExiusCart may have been seen, changed, lost or used by someone who should not have it, or where our systems were accessed without permission. For example:
- Someone signs in to a staff or merchant account they do not own
- A password, API key, or access token (including a Shopify token) leaks
- Customer names, emails, phone numbers or addresses are exposed
- Malware, a server break-in, or a lost device with access to our systems
Who is responsible
The NexCodeNova founder is the security lead and owns every incident from first report to final review. Admin staff only get the access their role allows, and every admin action is logged, so we can see who touched what.
How we respond
1. Detect and report
Anyone at NexCodeNova who sees a possible incident reports it to the security lead straight away. We also watch server alerts, failed sign-in spikes, certificate and uptime checks, and reports sent to support@exiuscart.com.
2. Contain
Within hours we stop the damage: revoke exposed keys and tokens, sign out affected sessions, disable affected accounts or integrations, and block the source of the attack.
3. Assess
We work out what happened, which shops and which data were involved (for example customer names, emails, phone numbers or addresses), and when it started, using our access and audit logs.
4. Notify
If merchant or customer personal data was exposed, we tell every affected merchant by email within 72 hours of confirming it: what happened, what data, what we have done and what they should do. Where the data came from Shopify, we also notify Shopify. We inform regulators where the law requires it.
5. Fix and recover
We remove the cause, restore from backups where needed, rotate credentials, and check that the fix holds before switching anything back on.
6. Review
Within two weeks we write up what happened, why, and what we changed so it does not happen again, and update this policy and our controls.
How we prevent incidents
- All traffic uses HTTPS; stored integration keys are encrypted
- Staff passwords need at least 12 characters with letters and numbers
- Role-based staff access that denies by default
- Audit log of admin actions and sign-ins
- Test data kept apart from live data
- Regular database backups
Report a security problem
Found a vulnerability or think your account was misused? Tell us. We reply within 2 business days and will not take action against anyone who reports in good faith.
NexCodeNova - Security