Tillzy / Information security policy

Information security policy

Last reviewed 11 October 2026; reviewed at least yearly.

This policy says how we protect Tillzy and the information shops keep in it. It only describes what is true today. Anything we haven't finished yet is marked Planned.

Scope

The Tillzy platform: this website, the help centre, the Tillzy admin our team uses, every shop's back office (where shop owners and staff work), and every shop's online storefront, including shops on their own domain.

Who is responsible

This policy belongs to Design Studio Lab Ltd. Tillzy is a trading name of Design Studio Lab Ltd, registered in England and Wales, company number 11222280. Registered office: 2 Damara Way, Ashford TN25 7FD. The company director owns it, makes sure it is followed, and leads the response to any security incident.

Data classification

We put every kind of information into one of four levels and handle it by that level.

Public

  • What: this website, the help centre guides, and what a shop publishes on its storefront.
  • Handling: anyone may read it. Only our team can change our website, and only a shop's staff can change its storefront.
  • Encryption: sent over HTTPS, as described under Encryption below.
  • Access: anyone can read it.

Internal

  • What: business data, such as a shop's products, costs, stock, suppliers, sales figures and settings, and Tillzy's own business records.
  • Handling: each shop's data is kept in its own separate database. Changes to stock and issued invoices are only ever added to, never rewritten.
  • Encryption: HTTPS in transit, as described below. Included in our encrypted backups.
  • Access: that shop's staff, only as far as their role allows (for example, cost prices are hidden from staff without that permission), and the Tillzy team when needed to run or support the service.

Confidential

  • What: personal data of shop owners, staff and shoppers, such as names, email addresses, delivery addresses and order history. Once marketplace connections go live, buyer details from marketplaces such as TikTok Shop will be treated the same way Planned.
  • Handling: used only to run the service. For a shop's customers we act only on the shop's instructions, as its processor. Kept and deleted as our retention periods say. Our support desk hides anything that looks like a card number, password or key before a message is saved.
  • Encryption: HTTPS in transit, as described below. Passwords are stored only as a one-way hash. Included in our encrypted backups.
  • Access: the shop's own staff, as their role allows, and the minimum Tillzy team needed to support the shop.

Restricted

  • What: secrets: payment, courier and Google keys and access tokens, two-step sign-in secrets, database passwords, and backups.
  • Handling: entered only in Tillzy's own settings screens. By design, once set up they aren't shown again in full, and we don't write them to our logs or activity records.
  • Encryption: encrypted in the database with AES-256. Backups are encrypted with AES-256 before they leave our server.
  • Access: a shop's keys only through its Settings, by staff whose role allows it. Tillzy's own keys can only be changed by the company's owners.

Access control and two-step sign-in

  • Shop staff see only their own shop, and only what their role allows. When an owner removes someone, they are signed out straight away.
  • In the Tillzy admin, only the company's owners can change platform settings and keys.
  • Every Tillzy admin account must use two-step sign-in with an authenticator app. A used code can't be used again.
  • Shop owners, and staff whose role can change settings or staff, refund orders, issue invoices and credit notes or see payouts, must use two-step sign-in, with 14 days to set it up. Other staff can switch it on for their own accounts, and we ask them to. Each person gets ten one-time recovery codes in case they lose their phone.
  • Staff and admin passwords must be at least 12 characters, and shoppers' at least 10. Every password is stored only as a one-way hash (bcrypt), so nobody can read it, including us.
  • Sign-in attempts are rate-limited. After 10 wrong passwords or 10 wrong codes in 15 minutes, a Tillzy admin or shop staff account is locked for 15 minutes and the account holder is emailed.

Encryption in transit and at rest

  • In transit: information is encrypted between your browser and Cloudflare, which fronts our service (HTTPS). Full end-to-end encryption all the way to our servers is being completed Planned. Our connections to Stripe and PayPal use HTTPS.
  • At rest: passwords are hashed. Keys, access tokens and two-step secrets are encrypted in the database (AES-256). Backups are encrypted (AES-256) before they leave our server.
  • Every page, including the back office, the admin and shops' storefronts, sends browser security headers: nosniff (X-Content-Type-Options), a referrer policy, a permissions policy and framing protection, so other websites can't show our pages in a frame. The back office and the admin also send a Content Security Policy in report-only mode, which reports problems but doesn't block anything yet. HTTP Strict Transport Security (HSTS) and an enforced Content Security Policy are Planned.

How secrets are stored

  • Every stored key, token and two-step secret is kept in an encrypted database column. By design, once set up it isn't sent back to the browser in full (a two-step secret is shown only while it is being set up).
  • Keys are entered only in Tillzy's own settings screens: Tillzy's in the admin, and a shop's in its back office Settings.
  • We will never ask you for a password, key or sign-in code by chat, phone or email. If one is pasted into a support message by mistake, our support desk hides it before the message is saved.

Payments

Card payments are handled by Stripe and PayPal, which are PCI DSS Level 1 certified. Shoppers enter their card details on Stripe's or PayPal's own pages, so Tillzy never sees or stores card numbers. Payment confirmations from Stripe are checked with a signature, and the amount and currency must match the basket.

Backups

Every night we back up each shop's database and our own, encrypt each copy (AES-256) on our server before it leaves, and store it in private Cloudflare R2 storage. We keep 14 days, plus one a month for six months. If a nightly backup fails and none has worked for 36 hours, the company's owners are emailed. We check by hand that a backup opens, and our Health page flags it if that hasn't been done for 30 days. Full test restores into a spare database are Planned.

Suppliers and sub-processors

The companies that handle personal data for us, what each does and what data it receives, are listed in our Trust centre's sub-processor list. Each gets only what it needs for its job. Hosting is with IONOS, and traffic passes through Cloudflare.

Logging and monitoring

  • Sign-ins, failed sign-ins and failed two-step codes are recorded, in the Tillzy admin's audit log and in each shop's activity log.
  • The audit log and shops' activity logs record who changed what and can only be added to, never edited.
  • By design, we don't write passwords, keys or card numbers to our logs.
  • The admin's Health page shows the state of the service. If a nightly backup fails and none has worked for 36 hours, the company's owners are emailed.
  • Uptime monitoring and error alerts are Planned.

Incident response

The company director leads the response to any security incident. We contain the problem, find out what happened and which shops and data were affected, and fix the cause. We tell affected shops without undue delay. Where UK GDPR requires it, we report a personal data breach to the Information Commissioner's Office within 72 hours of becoming aware of it. The full steps are in our Trust centre.

Reporting a vulnerability

If you think you've found a security weakness in Tillzy, please tell us before anyone else. Email [email protected] (also listed in our security.txt). We read every report. Please don't access, change or delete other people's data, don't run tests that could slow down or disrupt shops, and give us a reasonable time to fix the problem before you share it.

Staff and devices

We aim to keep full-disk encryption, a screen lock and automatic updates on the devices used to run Tillzy. Confirming two-step sign-in is on for every outside account used to run it, such as hosting, code, domain, payment and email accounts, is Planned. Getting certified under the UK government's Cyber Essentials scheme is Planned.

Review

Last reviewed 11 October 2026. We review this policy at least once a year, and whenever how we run Tillzy changes in a way that affects it.