SERVICE INFORMATION · Updated 23 October 2026

Security and responsible disclosure

Application controls

UnyMarket provides role-based access, optional multi-factor authentication and configurable inactivity timeouts for administrators and picking workstations. Administrators can require multi-factor authentication for all accounts. These access settings are optional by default; an installation's platform security assessment must reflect its enabled controls. Existing enrolled factors remain active until the account holder disables them using their password and second factor. Personal fields and documents are encrypted with AES-256-GCM before database storage. Credentials, data encryption, audit integrity and private search use distinct versioned keys. HTTPS and certificate-verified internal TLS protect application and database connections.

The HTTP application uses a database role without administration or table ownership. Migrations run in a separate maintenance process. Sensitive access and external API calls generate limited audit metadata, protected by an authenticated append-only chain and independent encrypted archive. The logs avoid copying customer response bodies or credentials.

Encryption keys and credentials

Versioned encryption keys are separated by purpose and held in access-restricted files outside source code, release images and ordinary exports. Key age is monitored and a rotation alert is raised at 365 days. The operating procedure covers planned rotation, replacement after suspected compromise, verification of newly encrypted data and retention of historical keys only while required for authorized recovery. Passwords are stored as one-way hashes. Packaging checks help prevent private paths and known secrets from entering releases.

Security records

Routine API audit records contain the operator identity, time, action, outcome, resource identifiers and an HMAC fingerprint of the originating IP address. They record field names and response metadata instead of copying request or response bodies. Customer names, delivery addresses, contact details, passwords and access tokens are not intentionally copied into these routine logs. Operator identifiers and security metadata can themselves constitute personal data; access and retention follow the separate security-evidence policy, with a minimum 12-month evidence period. Incident evidence is handled through restricted access.

Recovery and vulnerability management

Recovery uses authenticated encrypted backups and an isolated PostgreSQL environment before production access is reopened. The procedure verifies integrity, schema, encryption keys, connection revocations and the latest erasure journal. Completed database restore checks provide measured timings for that specific database and test; they are not a guarantee of a full-server recovery time. Recovery objectives and support arrangements are defined in the service agreement.

The operating policy schedules infrastructure and dependency vulnerability checks monthly and checks release candidates before deployment. Findings are tracked by severity, owner and remediation evidence. Source-code review, functional tests and security regressions complement dependency checks. Automated scans are not described as an independent penetration test.

Files and operations

Supported uploads are checked for actual file format, size, decompression limits and malicious content. Uploads are rejected if the malware scanner cannot confirm a safe result. Operational checks cover access reviews, security updates, key age, backups, restore tests and incident response. Critical findings have a seven-day remediation target and high findings a 30-day target; urgent exposure is contained immediately.

Report a vulnerability or incident

Write to contact@unymarket.com with the affected URL, time and a minimal reproduction. Do not include real customer data, credentials or exploit payloads that affect another customer. Request a secure exchange method when needed. Reports are assessed, recorded and assigned to a responsible operator. Platform and authority notifications follow the applicable contract and legal deadline.

This disclosure channel does not authorize intrusive testing of customer installations, denial of service, social engineering or access to another person's records. Independent assessments and contractual assurances are shared with authorized reviewers using actual dated evidence.