Data Classification & Encryption Policy

This Data Classification & Encryption Policy (the "Policy") describes how MyShipPilot LLC ("MyShipPilot", "we") classifies the data we handle and the encryption and handling requirements that apply to each classification. It applies to all personnel, contractors, and service accounts that process MyShipPilot data, and to the production systems that support the MyShipPilot shipping platform.

1. Classification levels

All data handled by MyShipPilot is assigned one of four classifications. Where data of mixed classification is combined, the highest applicable classification governs.

Public

Information intentionally published for general audiences. Examples: marketing pages, published rates and service descriptions, legal and security policy pages, help content. No confidentiality requirement; integrity and availability still matter.

Internal

Non-public operational information whose disclosure would not directly harm a customer. Examples: aggregate usage and volume metrics, internal runbooks, non-sensitive configuration, product roadmaps. Restricted to authorized personnel.

Confidential

Customer and business data that must be protected against unauthorized disclosure. Examples: account and contact details, shipment records, sender and recipient addresses, package contents descriptions, imported store order data, label and tracking records, payment and refund metadata (amounts, currency, status, processor reference identifiers), carrier billing adjustments, and support correspondence.

Restricted

The most sensitive values, where exposure could enable direct account or system compromise. Examples: authentication credentials, API keys and secrets, privileged service-role keys, encryption keys, and third-party integration access and refresh tokens (for example connected store platform tokens). Restricted data is accessible only server-side, only to the specific processes that require it, and is never returned to the browser.

2. Handling expectations

• Confidential and Restricted data is accessed only for a legitimate business purpose and only by personnel whose responsibilities require it.
• Confidential and Restricted data is not copied into informal channels, spreadsheets, chat messages, screenshots, or third-party tools that are not part of the approved production architecture.
• Imported data from connected store platforms passes an allow-list so that only the fields needed to create and track a shipment are retained (data minimization).
• Secrets and credentials are never committed to source control, never embedded in client-side code, and never written to logs.
• Application and audit logs record actor, role, action, and resource for sensitive administrative activity, and are scrubbed so that they do not carry secrets or payment card data.

3. Encryption in transit

All traffic to and from the MyShipPilot platform is served over HTTPS/TLS. Production responses are sent with HTTP Strict Transport Security (max-age=31536000; includeSubDomains; preload), and our Content Security Policy includes upgrade-insecure-requests, so browsers are instructed to use encrypted connections only. Connections between the application runtime and the managed database, and between the application and carrier, payment, and store-platform APIs, are made over TLS-protected endpoints. Additional protective response headers are applied in production, including X-Content-Type-Options, Referrer-Policy, Permissions-Policy, frame-ancestor restrictions, and a cross-origin opener policy.

4. Encryption at rest

MyShipPilot distinguishes two layers of encryption at rest, and we describe them separately so that they are not confused:

Provider-managed encryption. The production database is a managed PostgreSQL service operated by our infrastructure provider on AWS. Storage volumes and database backups are encrypted at rest by that provider using industry-standard (AES-256-class) volume encryption, with keys managed by the provider. This is a provider-supplied control; MyShipPilot does not operate the underlying disks or the keys that protect them, and we do not represent this as encryption performed by MyShipPilot's own application code.

Application-level encryption by MyShipPilot. In addition to the provider's volume encryption, MyShipPilot independently encrypts specific Restricted values before they are written to the database, using AES-256-GCM authenticated encryption with a per-record random initialization vector and authentication tag. This applies to third-party integration access and refresh tokens for connected store platforms, including TikTok Shop, Shopify, eBay, Etsy, and WooCommerce credentials. Encryption keys are held only in server-side secret configuration, are read only inside server handlers, and are never present in any browser bundle. Ciphertext that fails its authentication tag is rejected rather than used. Rows holding these encrypted values are additionally unreachable through the public data API.

Payment card data. MyShipPilot does not store payment card numbers. Card entry is handled directly by our payment processor's hosted card fields, and our records retain only non-card payment metadata such as amount, currency, status, and processor reference identifiers. We do not claim any payment-card certification.

Object/file storage. MyShipPilot does not operate customer-facing object storage buckets for Confidential or Restricted content. If object storage is introduced, it will be private by default, access-controlled server-side, and covered by this Policy.

5. Secrets and credential protection

Secrets, API keys, encryption keys, and privileged service credentials are stored in the managed secret store of our hosting platform and are read from server-side environment configuration inside server handlers only. They are never exposed with a client-visible build prefix, never shipped in browser bundles, and never logged. The privileged database client used for administrative operations is confined to server-only modules that cannot be imported into client code. Credentials are rotated or revoked when access ends or when exposure is suspected.

6. Least-privilege access

Access to Confidential and Restricted data follows least privilege. Authorization is role-based and enforced on the server, database row-level security policies scope each customer to their own records, and administrative pages sit behind a server-side role gate so that navigating to an administrative URL does not itself grant access. Privileged administrative actions require multi-factor authentication where implemented. Full detail is in our Access Control & Least Privilege Policy.

7. Retention and disposal

Data is retained only as long as needed for the purposes it was collected for, to operate shipping and billing, and to meet legal, tax, carrier-dispute, and fraud-prevention obligations. When a store integration is disconnected, the associated Restricted credentials are removed or invalidated. Records that must be retained for financial or dispute-evidence reasons are kept in a controlled, access-logged form. Disposal of data held in managed infrastructure relies on the provider's deletion of the underlying managed storage. See our Privacy Policy for customer-facing retention and deletion rights.

8. Exceptions

Any deviation from this Policy must be documented, justified by a business need, time-limited, and approved by the policy owner. Undocumented exceptions are not permitted.

9. Policy owner and review

This Policy is owned by MyShipPilot LLC. It is effective as of the date shown above and is reviewed at least annually and following material changes to our security posture, data handling, or systems. Material changes are reflected by updating the "Effective date" shown above.

10. Contact

Questions about this Policy may be directed to privacy@myshippilot.com or security@myshippilot.com.

This Policy is a governance statement and does not modify our Terms of Service. In the event of a conflict, the Terms of Service control with respect to your use of the Service.