Data Processing and Retention
Version 2.0 · Effective 2026-08-12 · [LEGAL ENTITY — TO BE DETERMINED] ("ShipOverpay", "we", "us")
A technical companion to the Privacy Policy, written for a customer's security or compliance reviewer. It describes the system as built.
1. Data inventory
| Category | Examples | Contains third-party personal data? |
|---|---|---|
| Account | name, work email, hashed password, role | No |
| Organization | company name, country, timezone | No |
| Uploaded documents | the carrier file as supplied, SHA-256, storage key | Possibly — carrier files often name recipients |
| Parsed shipments | tracking number, service, dates, origin/destination city, state, postal code, country, weights, dimensions, zone | Possibly |
| Charges | description, normalized type, amount in cents, source row and field | No |
| Findings | classification, amount, rule and version, reviewer, decision time | No |
| Recovery cases | amounts at each stage, carrier reference and response, confirmation source | No |
| Payment references | Stripe customer, payment method and payment intent identifiers, card brand, last four | No card numbers |
| Legal acceptances | document version, content hash, timestamp, IP, user agent, consent wording | No |
| Audit logs | actor, action, organization, timestamp | No |
| Founding applications | company, contact, email, phone, carrier, spend band, campaign source | No |
2. Where it lives
- Application and database: a single dedicated server, PostgreSQL 16.
- Uploaded files: on the same server, in a directory outside any web root, under server-generated names. Original filenames are metadata only. Every read passes through an authorized application route; there is no direct URL to a stored file.
- Backups: nightly database dumps with integrity checks and an automated weekly restore test. Currently stored on the same host — off-site copies are a known gap, tracked and not yet closed.
3. Access
- Customer data is visible to the members of that organization, by role.
- Our staff accounts can see invoices under review and recovery cases. Staff actions on findings, reviews and recoveries are recorded in append-only audit trails that the application provides no way to edit or delete.
- Server access is limited to the operators of the infrastructure.
4. Sub-processors
| Processor | Purpose |
|---|---|
| Hosting provider (dedicated server, WHM/cPanel) | Application, database, file storage, backups |
| Stripe | Payment processing, storage of payment methods |
| Mail relay (server-hosted today; Amazon SES planned) | Transactional email |
No advertising, analytics or session-recording third parties are present in the product.
5. Retention
| Data | How long we keep it | Still being finalized |
|---|---|---|
| Account and organization | While the account exists | Deletion window after closure |
| Uploaded files and parsed data | While the account exists | Whether to expire after N months automatically |
| Findings and audit runs | With the invoice | — |
| Recovery cases and fee records | Retained beyond account deletion for financial substantiation | Exact period |
| Legal acceptances | Retained as consent evidence | Exact period |
| Server logs | Standard rotation | Confirm period |
6. Deletion
docs/sop/remove-customer-data.md is the procedure. It separates what is deleted
from what is retained as a financial or consent record, and requires telling the
customer which is which rather than claiming a clean erase that did not happen.
7. Security measures actually in place
- TLS for all traffic; HSTS-eligible hosts.
- Passwords hashed; sessions signed; CSRF protection on state-changing forms.
- Uploads validated by type and size, deduplicated by SHA-256, and scanned for malware with a fail-closed policy: if the scanner is unavailable the upload is refused rather than accepted unscanned.
- Optimistic locking on records two people could edit at once.
- Payment webhooks verified by signature and recorded by event id, so a replay cannot charge or unlock twice.
- Stripe test mode only at the date of this version; no live payment credentials exist in the system.
8. What we do not have
Stated so that no reviewer has to guess: no SOC 2, no ISO 27001, no PCI DSS attestation of our own, no encryption at rest beyond the hosting layer, no off-site backup copies yet, no formal penetration test, no 24/7 on-call rota.