Security and Incident Response

• TLS for data in transit and provider-managed encryption at rest.
• AES-GCM encryption for connected-platform credentials with key-version metadata.
• Workspace-scoped authorization, short-lived OAuth/linking state, HMAC verification, replay protection, rate limits, and audit events.
• Private storage, upload validation and malware scanning, secret redaction, and production readiness gates.

Aimé will identify and contain an incident, preserve evidence, assess affected systems and data, remediate the cause, notify affected merchants and authorities when required, and document lessons and follow-up controls. Roles, notification timelines, and escalation contacts must be finalized before public launch.

Report suspected vulnerabilities or incidents to privacy@aimecommerce.app. Do not include access tokens, passwords, or unnecessary personal data.