Legal document

Security Policy

Last updated: 13 October 2026 · Version 1.2 · security@synqo-one.com

This is a translation provided for convenience. In case of any discrepancy, the Italian version prevails.

3.0 SRL, owner of the Synqo One platform, takes a proactive approach to security. This document describes the technical and organisational measures implemented to protect the platform, user data and the processing infrastructure.

1. Technical measures

HTTPS and TLS

All communications between browser and server are encrypted using TLS 1.2 or higher. The HTTP protocol is not accepted — every request is automatically redirected to HTTPS.

Password encryption

User passwords are never stored in plain text. They are encrypted with robust hashing algorithms (bcrypt) with an individual salt for each account.

Two-step verification

Each user can enable two-step verification (TOTP, compatible with common authenticator apps) from their settings: from then on, in addition to the password, logging in requires a temporary code generated on the phone. On activation, single-use recovery codes are provided, to be kept in case the device is lost. Verification is not mandatory: it remains each user's choice.

Encrypted backups

The database is backed up every night. Copies are kept on the server for 7 days and, as an encrypted copy, in off-server storage for 30 days. The key to decrypt them is not stored on the server. Restoration is tested periodically from a real copy.

Encrypted disks

All service data (database, files, certificates and logs) is held on a disk encrypted with 256-bit AES. The key that unlocks it is kept on a second, separate server, reachable only from the production server: a copied or stolen disk cannot be read.

Buyer data

Synqo One does not store the name, address, email or telephone number of people who buy on your channels. When you need to ship, the shipping data is requested from the channel at that moment, shown only to the administrators of your account who have two-step verification enabled, and not retained — neither in the database, nor in backups, nor in logs. Each opening is recorded, and there is a maximum number of openings per day.

Firewall and isolation

The production server is protected by a network-level firewall. Only the necessary ports (443, 80) are publicly exposed. The database is not accessible from outside, and administrative access to the servers cannot be reached from the internet.

Secure sessions

Access takes place with a signed token that expires automatically after 8 hours, after which you must authenticate again. The token travels only over HTTPS, in a request header and not in a cookie: the platform does not use session cookies. It is kept in the browser's session storage, so it is deleted when the tab is closed and on logout.

API protection

The internal APIs are protected by mandatory authentication. Users' marketplace credentials (e.g. Temu API Key) are stored in encrypted form in the database.

2. Organisational measures

2.1 Access control

User data is accessible only to 3.0 SRL personnel who need it for operational reasons (principle of least privilege).
Administrative access to the infrastructure takes place exclusively through an encrypted private network and with SSH keys — SSH password login is disabled and access is not exposed to the internet.
Buyers' shipping data is visible only to the administrators of the seller's account; the in-platform assistant has no access to it.
Administrative access is logged and subject to periodic review.
Personnel with access to production systems are bound by confidentiality obligations.

2.2 Authentication

Access requires a username and password. Passwords have a minimum length and are stored only as bcrypt hashes with an individual salt, never in plain text.
Repeated failed login attempts trigger automatic protection mechanisms (rate limiting, temporary lockout).

2.3 Updates and patches

The operating system and software packages are regularly updated with security patches.
The dependencies of the application code are reviewed for known vulnerabilities (CVEs), setting for each one the minimum version considered secure.
Critical security updates are applied within 48 hours of publication.

2.4 Suppliers and third parties

Suppliers that process data on behalf of 3.0 SRL (first and foremost hosting) are selected on the basis of their certifications and security guarantees.
The hosting provider (Hetzner) is ISO 27001 certified and operates in European data centres.
Subscription payments go through PayPal: 3.0 SRL does not receive or store card numbers.
Backup copies are encrypted before leaving the server and are kept by Backblaze in the EU, which cannot read them.

3. Monitoring and logging

Accesses and errors of the application and the server are recorded in the system logs.
Failed login attempts are recorded and feed the automatic lockout described in point 2.2.
Logins, account changes and openings of shipping data are kept for 90 days in a security log, which never contains passwords or buyer data.
At each release the new version is queried automatically: if it does not respond correctly, the release is cancelled and the service reverts to the previous version.

4. Security incident management

In the event of a data breach or security incident, we follow this process:

Detection and containment — the incident is identified, classified and isolated as soon as possible to limit its impact.
Assessment — analysis of the nature, scope and types of data involved within the first hours of the incident.
Notification to the Authority — if the incident poses a risk to the rights of data subjects, notification to the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) within 72 hours of discovery (Art. 33 GDPR).
Notification to sales channels — if the incident concerns data received from a marketplace, notification to the marketplace within the time limits set by its agreements (for Amazon, within 24 hours of discovery).
Notification to users — if the risk to the rights of data subjects is high, direct communication to the users concerned without undue delay (Art. 34 GDPR).
Remediation and post-mortem — resolution of the vulnerability, strengthening of preventive measures, documentation of the incident.

5. Service availability and continuity

The infrastructure is hosted on Hetzner servers in the European Union (Finland).
Daily backups allow data to be restored in the event of hardware failure or other adverse events.
Scheduled maintenance is communicated to users at least 24 hours in advance by email.

6. Vulnerability reporting

If you believe you have identified a security vulnerability in the Synqo One platform operated by 3.0 SRL, we ask you to report it responsibly (responsible disclosure) before making it public:

Send an email to security@synqo-one.com with a detailed description of the vulnerability.
We undertake to reply within 48 hours and to keep you informed of the progress of the fix.
We will not take legal action against anyone who reports vulnerabilities in good faith in accordance with these guidelines.

7. Updates to this policy

This policy is updated periodically to reflect the evolution of the security measures adopted. The "last updated" date at the top indicates the most recent version. Users will be notified of material changes by email.

8. Contact

For any question regarding the security of the platform: security@synqo-one.com
For general matters: info@synqo-one.com
3.0 SRL — Via Canaletta, 49 — 40027 Mordano (BO) — Italy — VAT no. 03685161204