Home › Information Security Policy
Last updated: 13 August 2026. This document describes how Eprojekty Jakub Milewski protects data processed in connection with its business activities - including seller and customer data shared through marketplace platform integrations.
This policy covers data processed while managing seller accounts, API integrations and automation for Eprojekty's clients. The policy owner and point of contact for security and data protection matters is Jakub Milewski (jm@eprojekty.eu).
Access to API keys, tokens and other credentials is granted on a need-to-know basis, limited to the people and processes that actually require them to carry out a task. Credentials are stored outside of source code repositories (never committed to version control) and are not shared with third parties.
Multi-factor authentication is enabled on the AWS account (console and IAM access management), on email mailboxes, and across practically every tool and administrative panel where the service provider supports it.
Workstations are protected with built-in antivirus software (Windows Defender) and basic security hygiene practices: screen lock on idle, strong passwords, and a clean-desk approach when handling documents containing sensitive data.
All network traffic related to client work and platform integrations is carried exclusively over encrypted connections (HTTPS/TLS) - this applies to the eprojekty.eu website, calls to marketplace platform APIs, and the AWS infrastructure (API Gateway, CloudFront) that enforces encryption in transit.
If a security incident is detected that may affect seller, customer or partner data, Jakub Milewski, as the point of contact, takes remedial action and notifies the affected party without undue delay. Security reports can be sent to jm@eprojekty.eu.
Software and dependencies in use are periodically reviewed and updated. Cloud service configurations (AWS) are reviewed for excessive permissions and unused resources.
After a client or partner relationship ends, data collected during it that is not required for legal or tax purposes is deleted.
As of the date of this document, Eprojekty Jakub Milewski does not hold formal information security certifications (e.g. ISO 27001, SOC 2). The practices described above reflect the operational measures actually in place.
This policy is reviewed at least once a year and after any material change to infrastructure or data processing.
Data handled in the course of our work is classified into four tiers. The tier determines storage, transmission, access and deletion rules. Encryption is applied to all tiers, at rest and in transit; classification adds handling rules on top of that baseline.
T1 – Secret. Credentials, API keys, application secrets, OAuth access and refresh tokens, cloud access keys. Stored only in the dedicated secrets directory, which is excluded from version control and encrypted at rest, or in a hosting platform's managed secret store. Never committed to a repository, never embedded in code, never sent by email or chat, never shared with clients or contractors. One credential set per integration, so no credential grants access beyond its purpose. Rotated on any suspicion of exposure. Never written to logs.
T2 – Confidential. Personal data, including recipient details within marketplace orders, and client business data such as pricing, sales figures and commercial terms. Processed only for the purpose it was provided for and only for the client it belongs to. Not aggregated across clients, not used for marketing, not used to train models, not enriched from other sources. Access limited to the owner. Retained only as long as necessary, then deleted; deleted on client request or on termination of the engagement. Excluded from application logs.
T3 – Internal. Product and catalogue data, operational and system logs containing no personal data, internal documentation and configuration. Access limited to the owner and, where a specific task requires it, to a contractor for the duration of that task. Not published. Retained while operationally useful.
T4 – Public. Published website content, these policies, and material deliberately made public. No restriction on disclosure; integrity is maintained through our controlled deployment process.
Where a record could fall into more than one tier, the highest applicable tier governs its handling in full. An order record containing recipient details is therefore treated as T2 in its entirety rather than split.