Security and compliance posture
Written as commitments with owners, not as badges. Where something is planned rather than done, it says so.
What we commit to
| Area | Commitment | Status |
|---|---|---|
| Data residency | All customer and order data stored and processed inside the European Economic Area. | Committed |
| Card data | We never store raw card numbers. Card payments are tokenised at the provider; the platform holds tokens only. | Committed |
| BLIK | Authorisation happens in the customer's banking app. No credentials transit the platform. | Committed |
| Agent payments | Scoped payment tokens only, with a default 2 000 PLN human-approval ceiling.[1] | Committed |
| GDPR | Controller/processor roles documented per integration; a live record of processing activities; standard contractual clauses with sub-processors. | In preparation |
| DSA | Notice-and-action intake for illegal content, a transparency report, and a designated single point of contact. | In preparation |
| GPSR | Product-safety fields on every listing: manufacturer, EU responsible person, warnings and traceability data. | In preparation |
| Omnibus | Discount badges show the lowest price applied in the 30 days before the reduction, computed from real price history. | Committed |
| Penetration testing | External test before launch and annually thereafter, with a summary published after remediation. | Planned |
| Incident response | Named on-call owner, 72-hour breach notification pathway, and a public status page. | Planned |
Reporting a vulnerability
Email security@swiftshop.pl. We aim to acknowledge within two business days and to complete a remediation decision within 90 days, in line with a coordinated-disclosure model.
A machine-readable contact file will be published at /.well-known/security.txt with a PGP key before public launch.
We will not pursue legal action against researchers who follow the published policy: test only against your own accounts, do not access other people's data, do not degrade the service, and give us the agreed remediation window.
Categories of sub-processor
The platform is built on a small number of categories of supplier. Every one is disclosed, contractually bound and selected for EEA data residency.
- Edge and CDN — serves the storefront and terminates TLS.
- Payment service providers — licensed acquirers and PSPs supporting BLIK, cards and pay-by-later.
- Logistics carriers — locker and courier networks delivering in Poland and the EU.
- E-mail and transactional messaging — order, invoice and delivery notifications.
- Observability and error tracking — with personal data minimised or hashed before transmission.
A named list with registered addresses and processing locations will be maintained at /legal/sub-processors from the beta phase onward. Merchants receive 30 days' notice before any new sub-processor is added.
Sources cited on this page
Every figure above is drawn from the sources listed here. The machine-readable register lives at /data/market-data.json.
SwiftShop.pl is pre-launch. Figures come from the sources below; projections are labelled as such.