Information security policy

Who is responsible

This policy is carried out by Sellit LLC (identification number 405898006; registered address: 9 Vazha-Pshavela Avenue, Saburtalo District, Tbilisi, Georgia). Questions: contact@sellit.ge.

Card data

You never enter card details on a Sellit page. When you pay by card you go to the payment provider's (a bank's or a payment system's) secure page and enter the card number, expiry date and CVV only there. Your bank may ask you to confirm the payment with an SMS code or its app (3-D Secure).

Neither Sellit nor the shops can see or store those card details. We receive only the result of the payment: paid or not.

Encrypted connections

Sellit pages, shops and the API work over an encrypted connection (HTTPS, TLS).

Accounts and sign-in

We do not store passwords: we store only a hash, from which the password cannot be recovered. You can also sign in with a one-time SMS code.

Browser scripts cannot read the session cookie (HttpOnly). We limit sign-in and code requests so that passwords and codes are hard to guess.

Access and separation of shop data

Each shop's data is kept apart from other shops: the system shows a shop only its own products, orders and buyers. Inside a shop, a staff member has only the rights of their role.

Sensitive administrator actions need a second factor (a one-time code), and every administrator change is written to a log.

Secret keys

We store the keys of payment and delivery providers and the tokens of integrations (Facebook, Instagram and others) encrypted. The master encryption key exists only in the server environment. We never write keys to logs.

Backups

We back up the database every hour and every day to private (non-public) storage: hourly copies are kept 7 days, daily copies 90 days. Restoring from a copy is tested, so data can be restored after an error or an incident.

Incidents

We investigate and contain a security incident at once. If it concerns personal data, we notify the Personal Data Protection Service and the people affected in the manner and within the period set by the Law of Georgia on Personal Data Protection.

Reporting a security issue

If you notice a weakness or suspicious activity, email contact@sellit.ge with the subject “Security”. Please tell us first and do not publish the issue before it is fixed.

Sellit never asks for your password, SMS code or card details by phone, email or message. Do not answer such a request, and tell us about it.

Law

We process personal data under the Law of Georgia on Personal Data Protection. Details: the Privacy Policy.