---
title: "Trust, security and compliance — SwiftShop.pl"
description: "SwiftShop.pl security and compliance posture: EU data residency, PCI DSS via tokenisation, GDPR, DSA, GPSR, Omnibus price history and incident response commitments."
lang: en
url: https://swiftshop.pl/trust/
markdown_url: https://swiftshop.pl/trust/index.md
section: trust
updated: 2026-10-10
sources:
  - id: acp_stripe
    org: "Stripe"
    url: https://docs.stripe.com/agentic-commerce/acp
    date: 2025-10-01
---

# Security and compliance posture

Written as commitments with owners, not as badges. Where something is planned rather than done, it says so.

## What we commit to

**Security and compliance commitments**

| Area | Commitment | Status |
|---|---|---|
| Data residency | All customer and order data stored and processed inside the European Economic Area. | Committed |
| Card data | We never store raw card numbers. Card payments are tokenised at the provider; the platform holds tokens only. | Committed |
| BLIK | Authorisation happens in the customer's banking app. No credentials transit the platform. | Committed |
| Agent payments | Scoped payment tokens only, with a default 2 000 PLN human-approval ceiling.[1] | Committed |
| GDPR | Controller/processor roles documented per integration; a live record of processing activities; standard contractual clauses with sub-processors. | In preparation |
| DSA | Notice-and-action intake for illegal content, a transparency report, and a designated single point of contact. | In preparation |
| GPSR | Product-safety fields on every listing: manufacturer, EU responsible person, warnings and traceability data. | In preparation |
| Omnibus | Discount badges show the lowest price applied in the 30 days before the reduction, computed from real price history. | Committed |
| Penetration testing | External test before launch and annually thereafter, with a summary published after remediation. | Planned |
| Incident response | Named on-call owner, 72-hour breach notification pathway, and a public status page. | Planned |

## Reporting a vulnerability

Email security@swiftshop.pl. We aim to acknowledge within two business days and to complete a remediation decision within 90 days, in line with a coordinated-disclosure model.

A machine-readable contact file will be published at /.well-known/security.txt with a PGP key before public launch.

We will not pursue legal action against researchers who follow the published policy: test only against your own accounts, do not access other people's data, do not degrade the service, and give us the agreed remediation window.

## Categories of sub-processor

The platform is built on a small number of categories of supplier. Every one is disclosed, contractually bound and selected for EEA data residency.

- Edge and CDN — serves the storefront and terminates TLS.
- Payment service providers — licensed acquirers and PSPs supporting BLIK, cards and pay-by-later.
- Logistics carriers — locker and courier networks delivering in Poland and the EU.
- E-mail and transactional messaging — order, invoice and delivery notifications.
- Observability and error tracking — with personal data minimised or hashed before transmission.

A named list with registered addresses and processing locations will be maintained at /legal/sub-processors from the beta phase onward. Merchants receive 30 days' notice before any new sub-processor is added.

## Sources

1. Stripe. [Agentic Commerce Protocol — integration documentation](https://docs.stripe.com/agentic-commerce/acp) — 2025-10-01