Information Security Policy

User Data and Management

Lunaris limits its personnel’s access to user data as follows:

• Requires unique user access authorization through secure logins and passwords, including multi-factor authentication for administrator access;
• Limits the user data available to Lunaris personnel on a “need to know” basis;
• Encrypts user security credentials for production access.
• Lunaris logically separates each of its users’ data and maintains measures designed to prevent user data from being exposed to or accessed by other users.
• Restricts access to EasyPoints’ production environment by Lunaris personnel on the basis of business need; and

Data Encryption

Lunaris provides industry-standard encryption for user data as follows:

• Implements encryption in transport and at rest;
• Uses strong encryption methodologies to protect user data, including AES 256-bit encryption for user data stored in Lunaris’ production environment; and
• Encrypts all user data located in cloud storage while at rest.

Network Security, Physical Security and Environmental Controls

• You are solely responsible for properly canceling your subscription. An email or phone request to cancel your subscription is not considered cancellation. You can cancel your subscription at any time in the EasyPoints user interface or by uninstalling EasyPoints from your Shopify store.
• Lunaris maintains measures designed to assess, test and apply security patches to all relevant systems and applications used to provide the Services.
• Lunaris monitors privileged access to applications that process user data, including cloud services.
• EasyPoints operates on Amazon Web Services (“AWS”) and is protected by the security and environmental controls of Amazon. Detailed information about AWS security is available at https://aws.amazon.com/security/ and http://aws.amazon.com/security/sharing-the-security-responsibility/. For AWS SOC Reports, please see https://aws.amazon.com/compliance/soc-faqs/.
• User data stored within AWS is encrypted at all times. AWS does not have access to unencrypted user data.

Incident Response

If Lunaris becomes aware of unauthorized access or disclosure of user data under its control (a “Breach”), Lunaris will:

• Take reasonable measures to mitigate the harmful effects of the Breach and prevent further unauthorized access or disclosure.
• Upon confirmation of the Breach, notify the client in writing of the Breach without undue delay. Notwithstanding the foregoing, Lunaris is not required to make such notice to the extent prohibited by applicable laws, and Lunaris may delay such notice as requested by law enforcement and/or in light of Lunaris legitimate needs to investigate or remediate the matter before providing notice.

Each notice of a Breach will include:

• The extent to which user data has been, or is reasonably believed to have been, used, accessed, acquired or disclosed during the Breach;
• A description of what happened, including the date of the Breach and the date of discovery of the Breach, if known;
• The scope of the Breach, to the extent known; and
• A description of Lunaris’ response to the Breach, including steps Lunaris has taken to mitigate the harm caused by the Breach.