Phaeros Inc. takes reports of suspected security issues affecting Orbit seriously. Shopify does not operate or support Orbit.
Report a vulnerability or security concern
General support: hello@phaeros.co
Please report suspected vulnerabilities, exposed credentials, unauthorized access, or suspected exposure of Orbit or Shopify-connected customer data as soon as possible.
Include:
- a clear description of the issue;
- the affected URL, feature, or organization, if known;
- steps to reproduce, if safe to provide;
- the potential impact; and
- a way to contact you for follow-up.
Do not include passwords, API tokens, payment-card details, or unnecessary personal information in an initial report. If sensitive information must be shared, contact us first to request a secure method.
Responsible disclosure
Please give us a reasonable opportunity to investigate and address a reported issue before making it public.
Do not access, alter, download, disclose, or retain data that is not yours; disrupt or degrade the service; or use a vulnerability to harm users or systems.
Good-faith reports that follow these guidelines help Phaeros identify and address security issues affecting Orbit and its users.
How Phaeros responds
The Phaeros Privacy & Security Owner is the primary incident owner, with technical and executive support as needed.
For a suspected security incident, Phaeros’s response process is designed to:
- acknowledge, triage, and record the report;
- contain the issue, including revoking or rotating affected credentials or Shopify access where appropriate;
- investigate the affected systems, stores, customers, and information;
- preserve relevant evidence and determine the scope and impact;
- remediate the issue and restore secure operations;
- assess and make notifications required by applicable law, contract, or platform requirements; and
- document the incident and prevention work.
For actual or suspected breaches of Shopify merchant data, Phaeros will follow applicable Shopify notification requirements, including notifying Shopify promptly and no later than 24 hours after becoming aware of the breach where that requirement applies. This does not replace any separate legal, contractual, merchant, or individual notification obligations.
Access and safeguards
Orbit limits access to protected Shopify customer data and other sensitive information to designated personnel with a legitimate support, security, or operational need.
Authorized access is subject to appropriate authentication and least-privilege access controls. Relevant access is logged for security and audit purposes.
Protected Shopify customer-data access audit records are retained in accordance with the Data Retention Policy.
Phaeros reviews applicable protected-customer-data access records monthly to identify unusual, unauthorized, or otherwise inappropriate access.
Phaeros also reviews permanently failed Shopify webhook processing monthly to identify issues that may affect privacy requests, purchase attribution, rewards processing, or other Shopify-connected operations.
Shopify access tokens are encrypted at rest.
Orbit uses multi-factor authentication (MFA) for account access. Employees with production or administrative access are required to use MFA and are granted access only as needed for their role. We restrict and log access to protected customer data. If we suspect unauthorized access, we contain it, assess the impact, and make notification decisions under applicable law and agreements.
Privacy and account concerns
For access, correction, or deletion requests, contact hello@phaeros.co with the subject line “Privacy Request.”
Shopify customer and merchant privacy requests are handled separately from general Orbit account deletion where applicable.
Orbit account deletion is currently handled as a verified, support-assisted process rather than fully automated self-service deletion. See the Privacy Policy, Customer Data Policy, and Support page for more information.
For lost account access or a non-security product issue, see Support.
Contact details
Phaeros Inc.
Privacy / general: hello@phaeros.co