Security, storage and retention

Where files and data are stored

Proof files (videos, photos and documents) are kept in encrypted object storage. The application server and the database are hosted in Germany (EU).

Customers who need the list of providers that process data on our behalf can find it in our Data Processing Agreement.

Encryption in transit

Every page, API call and file transfer uses HTTPS. The site sends a long-lived HSTS header, so browsers refuse to connect over plain HTTP.

Who can open a proof

• Proof files are never public. They are delivered through signed links that expire, by default after one hour.
• Buyer approval links use a long random token. PallasMark stores only a hash of that token, and the link expires after 7 days by default; the merchant can send a new one.
• Warehouse and pallet share links last between 1 and 30 days, can require a PIN, can block downloads, and can be revoked at any time. Each opening is counted.
• Inside a workspace, access follows roles (owner, admin, staff, operator) and per-order permissions, for example who may download evidence.
• Two-step sign-in with an authenticator app and recovery codes is available to every user. Sign-ins are written to a signed, hash-chained log.

Integrity of evidence

Every recording is sealed with a SHA-256 fingerprint and gets a public verification link anyone can check. The verification page shows how to compare a file yourself.

How long proofs are kept

Current plan retention periods: 90 days. The period is fixed when a proof is created and counted from that date, so a later plan change does not shorten what you already recorded.

Proofs are removed 30 days after their retention period ends. Any order with an open dispute, chargeback or return is kept and never deleted. Card disputes can be raised months after delivery, so check that your plan's retention covers the dispute window you face.

Deleting data

Account owners can request deletion of their workspace data by email; we complete it within 30 days. Data-redaction requests that Shopify sends on behalf of a shop or its customers are processed automatically.

Reporting a security issue

Email hello@pallasmark.com with "Security" in the subject line. Security reports are triaged as soon as they arrive. Please do not include passwords, tokens or customer data in the message.