Trust & Security

What exists today

Relisentry is an early-stage, founder-led independent QA service. The public site is intended to be served over HTTPS on Netlify at relisentry.com, with the earlier Lovable version still available; it has email inquiry links and a clearly labeled synthetic browser demonstration. It has no client login, payment form or merchant-data upload interface. Cloud/authentication scaffolding exists in the project but the public pages do not provide a client portal. The Privacy Policy explains hosting analytics, font requests and error-reporting code.

We do not claim SOC 2, ISO 27001, GDPR certification, independent penetration testing, a dedicated security operations team, specific encryption-at-rest arrangements or a tested incident-response SLA. Availability of a platform feature is not proof that it is configured for a client engagement.

Written authorization comes first

No audit starts without written authorization from the system owner or a person with documented authority. An agency must establish the merchant's authorization; commissioning work does not itself grant access to third-party systems. Agreed boundaries identify domains, storefronts, environments, activities, timing and a contact able to stop testing.

Release QA is limited to agreed functional buyer journeys. It is not authorization for penetration testing, load testing, exploitation, data extraction or testing third-party services outside the agreed scope.

Minimum necessary access

Use the least privilege and shortest practical access period. Prefer test environments and named test accounts with synthetic data. Where Shopify admin access is needed, request scoped collaborator access through Shopify's supported process, subject to merchant approval and account eligibility. Do not share the store owner's login, password, MFA codes or personal recovery codes.

Before use, agree credential delivery, access recipients and revocation. Do not put secrets in email threads, reports, public repositories or this website. If appropriate scoped access cannot be arranged, restrict or pause the affected checks.

Production and transaction boundaries

No real orders, charges, refunds, customer communications, configuration changes, deployments or other production writes without explicit written permission covering the exact action. Prefer test gateways and test data in authorized environments; enabling a test payment mode on a live store can affect customers and also requires approval.

Pause testing if the permitted boundary is unclear or an unexpected risk to real customers appears. Escalate to the named client contact rather than expanding the scope independently.

Confidential findings and evidence

Treat non-public findings, screenshots, traces, account information and business rules as confidential. Minimize collection and redact customer details, session tokens and secrets from evidence. Share only with agreed recipients using a transfer method approved during onboarding. Public examples and case studies require separate written permission; synthetic demonstrations are labeled as such.

Storage locations, recipients, access restrictions, delivery methods and deletion dates must be documented before confidential client material is collected. This is an engagement requirement, not a claim that a certified storage system is already operating.

Tools, AI and collaborators

Disclose proposed external testing, storage, AI and collaboration tools before sharing client information. Obtain approval for relevant providers, data locations and subcontractors, and applicable confidentiality/processor terms. Do not send client credentials, source code, customer records or private evidence to general-purpose AI services without explicit approval and suitable terms.

Use synthetic or minimized data wherever practical. A subcontractor must not receive access merely because they are available; the client-approved scope and access permissions apply to them too.

Report a security concern

Email teakukic07@gmail.com with Security report in the subject. Include the affected public URL, a concise description and safe reproduction details; do not include live secrets or customer data. This address is not a 24/7 monitored hotline and no response-time guarantee is made.

For engagement incidents, stop affected testing, limit exposure where authorized, preserve minimal relevant evidence and notify the designated client contact without undue delay under the applicable contract and law. The client-specific notification process, responsibilities and legal deadlines must be agreed in advance. Do not investigate outside authorization or publicly disclose client findings without approval.

Limits and accountability

A release recommendation describes only the scenarios, environments and version actually assessed. It is advisory, not launch authorization, a warranty of security, a compliance certification or a guarantee of bug-free operation. Fixes, continuous monitoring and unagreed activities are outside the published audit scope. Contact Tea to confirm the safeguards available for your project before supplying access.