All developers must complete the security questionnaire before an app is approved. This applies to public apps, private apps, and integration-only apps.

Security Requirements

Any application, integration, or software component developed for or connected to Commerce7's platform ("Partner App") must comply with these security requirements. These are binding obligations incorporating industry-standard security practices (OWASP Top 10, NIST, ISO 27001). This includes apps that are unpublished, private, released to specific tenants, running in Test mode, or built as one-off integrations or data migrations for a single client.

1. Secure Communication

Use HTTPS with TLS 1.2 or higher for all data in transit. Validate SSL/TLS certificates. Insecure protocols (SSL, TLS 1.0, TLS 1.1) are prohibited.
Never transmit or expose App Secret Keys, App IDs, API tokens, passwords, or authentication credentials in plain text or reversible encoding (including Base64). Implement secrets management and automated scanning to detect exposed credentials.

2. Authentication and Authorization

App Secret Keys and App IDs

Treat App Secret Keys as highly sensitive. Implement role-based access controls with multi-factor authentication for personnel accessing secrets. Maintain audit logs of secret access.
Never hardcode secrets in client-side code (JavaScript, HTML, mobile apps, browser extensions), configuration files, or any code that may be decompiled. Implement automated scanning to prevent such exposures.
Rotate keys at least every 90 days and immediately upon suspected compromise or personnel changes. Revoke compromised keys within 1 hour and notify Commerce7 immediately.

API Scopes

Request only the minimum API scopes and permissions necessary for your app's documented functionality. Review permissions regularly and remove unnecessary access. Additional scopes require Commerce7 approval.

3. Data Protection

Encrypt sensitive data at rest using AES-256 or equivalent. Store encryption keys separately from encrypted data. Use secure key management services where appropriate.
Collect only the minimum data necessary. Never store payment card data (PAN, CVV, PIN) per PCI DSS. Securely delete data when no longer needed.
Provide mechanisms for data deletion, portability, and correction per GDPR/CCPA. Complete deletion requests within 30 days. Upon termination or Commerce7's request, delete all Commerce7 customer data within 30 days and certify deletion in writing.

4. Input Validation and Output Encoding

Validate and sanitize all user input, API requests, and file uploads on the server side. Use allowlist validation where possible. Implement input length restrictions, type checking, and format validation.
Sanitize and encode all outputs to prevent XSS, SQL injection, and other injection attacks. Use context-appropriate encoding and Content Security Policy headers. Use prepared statements and parameterized queries for all database operations.

5. Session Management

Use secure, cryptographically random session tokens. Implement secure cookies (HttpOnly, Secure, SameSite=Strict). Regenerate tokens after authentication. Implement session timeouts (maximum 24 hours absolute, 30 minutes idle for sensitive operations).
Implement CSRF protection using synchronizer tokens or double-submit cookies. Provide secure logout that invalidates sessions on client and server. Invalidate sessions upon password changes or security incidents.

6. Error Handling and Logging

Do not expose stack traces, system information, database details, or sensitive data in error messages. Use generic error messages for users while logging detailed errors securely for debugging.
Log all authentication attempts, authorization decisions, data access, and security events with timestamps, user identifiers, and IP addresses. Retain logs for 12 months minimum. Protect log integrity and implement monitoring for suspicious activity. Never log passwords, payment information, or full API keys.

7. Compliance

Comply with GDPR, CCPA, and other applicable privacy laws.
Publish and maintain a clear Privacy Policy describing data collection, use, sharing, retention, and deletion.
Respond to data access, deletion, and privacy rights requests within 30 days. Cooperate with Commerce7 on requests related to Commerce7 customer data within 5 business days.

8. Secure Dependencies

Keep all libraries, frameworks, and dependencies updated with current security patches. Implement automated vulnerability scanning at least weekly. Remediate critical vulnerabilities within 7 days and high-severity vulnerabilities within 30 days.
Use automated security scanning tools (npm audit, OWASP Dependency-Check, Snyk, or equivalent). Integrate security scans into your deployment pipeline and block deployments with critical vulnerabilities.

9. Content Security

Implement Content Security Policy (CSP) to prevent XSS and code injection. Avoid 'unsafe-inline' and 'unsafe-eval' where possible. Implement security headers (X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy).
Avoid inline scripts, styles, and event handlers. Use external files with Subresource Integrity (SRI) attributes for third-party resources.

10. Third-Party Services and AI Tools

Disclose every third-party service your app sends Commerce7 data to, including hosting, analytics, and data processors. Name them at registration and at submission.
Use of AI systems, tools, or models in connection with Commerce7 data requires prior written approval from Commerce7. This includes generative AI, machine learning models, coding assistants, chatbots, and automated decision-making systems, whether the data is used for analysis, development, training, or reporting.
Do not send Commerce7 customer data to any AI service without that approval. Approval is specific to the tools and purposes disclosed. Adding new tools requires a new approval.
Never use Commerce7 customer data to train or fine-tune a model.

Ongoing Responsibilities

Maintain security of your Partner App at all times. This includes promptly addressing any security vulnerabilities, misconfigurations, or other risks identified by the Partner, Commerce7, or any third-party assessment. Promptly address vulnerabilities within specified timelines.

Notification of Incidents

Notify Commerce7 within 4 hours of any security incident, data breach, unauthorized access, or critical/high vulnerability.

Company’s Right to Audit or Review

Commerce7 may review, audit, or evaluate your app's security at any time (with reasonable notice except for suspected incidents). This includes security assessments, code reviews, and requesting security documentation. Cooperate fully and provide requested information within 5 business days.

Remediation & Enforcement

If your app is non-compliant or poses risk, Commerce7 may: (1) require corrective actions within specified timelines (critical: 24 hours; high: 7 days; medium: 30 days; low: 90 days); (2) immediately suspend or remove your app; (3) restrict platform access; or (4) recover costs incurred responding to security failures.

Liability and Legal Action

Failure to comply constitutes material breach. Partner shall indemnify and hold harmless Commerce7 from all claims, damages, and expenses arising from: (1) breach of these requirements; (2) security incidents involving the Partner App; (3) violation of laws; or (4) third-party claims related to security practices. Commerce7 reserves all legal remedies including damages, injunctive relief, and termination. These obligations survive termination.