Data Security Policy

1. Payment security

• Online payments run through EPS (eps.com.bd), a Bangladesh Bank–approved payment gateway that complies with PCI-DSS.
• Card details, mobile banking PINs and OTPs are entered directly on EPS's secure page — they never reach or stay on our servers.
• We store only the payment result, amount and transaction ID.
• Our staff will never ask for your PIN, OTP or password by phone, SMS or WhatsApp.

2. Encryption

• Every connection to the website, software and API is encrypted with HTTPS (TLS).
• Passwords are never stored as plain text — only as strong one-way hashes.
• Databases and backups sit on secured servers, and sensitive fields are encrypted.

3. Access control

• Role-based permissions in the software: the owner decides what each staff member can see and do.
• Audit log: a record of who changed what, and when.
• Each business's data is kept separate, so one customer can never see another's.
• Within our team, only a limited number of staff can access customer data, only for support and maintenance, and all are bound by confidentiality agreements.

4. Servers and backups

• The service runs on secured cloud infrastructure with firewalls and regular security updates.
• Automated backups are taken regularly and stored separately, so data can be restored if something goes wrong.
• Suspicious logins and unusual activity are monitored.

5. If an incident happens

If we detect a data breach or unauthorised access, we act immediately to contain it. If your information is affected, we tell you within 72 hours — what happened, what data was involved and what you should do. Where required, we also notify the relevant authorities and payment providers.

6. What you can do

• Use a strong, unique password and never share it.
• Give every staff member their own login with only the permissions they need.
• Disable a staff member's account as soon as they leave.
• Sign out when you finish on a shared computer.
• Tell us about any call or message claiming to be StoreOS that asks for a PIN, OTP or password.

7. Reporting a vulnerability

If you find a security weakness in our software or website, please email the details to the address below. We take every responsibly reported issue seriously and ask that you do not disclose it publicly until it is fixed.