Security

Last updated 7 November 2026

This is Fikr Labs Limited's information security policy for Zepsell. It applies to everyone who works on Zepsell and every system that holds merchant or customer data. How we use personal data is set out in our privacy policy.

Access

Access follows least privilege, is protected by multi-factor authentication and is removed as soon as it is no longer needed.

Data protection

We classify the data we hold and protect it accordingly. Data is encrypted in transit, sensitive data is encrypted at rest, and backups are encrypted. Card details go straight to the payment provider and never reach us. We never sell personal data or use it for advertising.

Infrastructure and monitoring

Our systems are protected at the network edge, stores are isolated from each other, and everything is monitored around the clock so we can act quickly.

Vulnerabilities

We keep software up to date and apply security fixes promptly. If you think you've found a security problem, email [email protected] and give us a chance to fix it before telling anyone else.

Incidents

Every incident has an owner who contains it, finds out what happened and makes sure the right people are told: affected merchants without undue delay, and regulators and partner platforms where the law or their terms require it. Report an incident to [email protected].

Data requests and deletion

We help merchants answer their customers' data requests. When a merchant disconnects an app we delete its access, and when a merchant closes their account we delete their data.

Reviews

We review this policy at least once a year.