Security, Privacy & Compliance
MesColis handles shipping data for hundreds of Canadian SMBs. This page documents our practices, infrastructure, sub-processors, and compliance commitments — for you, your procurement team, and your auditors.
Compliance Status
We document every certification honestly — what we hold today, what's in progress, and what's not applicable.
PCI-DSS
Compliant via Stripe Elements — we never touch card data.
PIPEDA
Canadian privacy law — fully applicable.
GDPR
GDPR-compatible practices (data export, right to erasure, DPA available).
SOC 2 Type II
Not certified. No SOC 2 report for our platform is currently published.
Annual Penetration Test
No independent penetration test report is currently published. Contact us for the status of any engagement.
ISO 27001
Evaluated based on enterprise customer demand.
Security Practices
Encryption in Transit
Public pages use HTTPS and publish an HSTS header to request encrypted connections from supporting browsers.
Encryption at Rest
All data encrypted AES-256 at rest via Supabase (Postgres with native encryption). Label and invoice PDFs stored encrypted in Supabase Storage.
Authentication & Access
Auth managed by Supabase Auth (JWT + secure cookies). User/admin/super_admin roles with role-based access control (RBAC). Row-Level Security (RLS) enforced on every user-data table.
Multi-Factor Authentication
TOTP MFA available for all admin accounts. Customer-facing rollout in progress.
Rate Limiting
50+ API routes protected by Upstash Redis-backed rate limiting. Per-IP + per-user limits, standards-compliant Retry-After headers.
Monitoring & Alerts
Errors tracked via Sentry. Application logs in Vercel Observability. Alerts configured for error spikes and payment failures.
Audit Trails
Structured audit_logs table recording every admin action (cancellations, refunds, adjustments). Indefinite retention for compliance.
Payment Idempotency
All payment routes (create, cancel, refund) are idempotent. Replay-guard checks the DB before any external Stripe/PayPal/NOWPayments call.
BOLA Protection
Every API route checks user_id ownership before returning user data. Prevents object enumeration and unauthorized access (OWASP API1).
Input Validation
All PATCH/PUT routes use explicit field allowlists (ALLOWED). No mass-assignment permitted.
Signed Webhooks
Easyship, SendGrid, and Stripe webhooks verified via HMAC signature with constant-time comparison (timingSafeEqual).
Bidirectional EDI 214
Standards-compliant X12 EDI 214 generation + parsing for enterprise partners. Native support for carrier shipment status feeds.
Infrastructure & Data Residency
Database
Supabase Postgres hosted in AWS ca-central-1 in Canada. Backup and restoration arrangements should be confirmed as part of your security review.
Compute
Next.js application hosted on Vercel. The verified deployment uses functions in the US iad1 region and a global CDN.
Storage
Supabase Storage (S3-backed). Label PDFs, invoices, brand assets. RLS-gated access.
Availability
99.9% uptime target (~8h45 max downtime/year). Circuit breakers on carrier APIs for graceful degradation.
Sub-Processors
Every third-party entity that processes customer data. Updated at least 30 days before any new sub-processor is added. To be notified of changes by email, contact privacy@mescolis.ca.
| Vendor | Purpose | Data | Region | Compliance |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage | User profiles, shipments, invoices, label PDFs | AWS · ca-central-1 (Canada) | SOC 2 Type II, HIPAA |
| Vercel | Hosting, serverless functions, CDN | Code, data processed by functions and request logs | Functions: iad1 (USA) · Global CDN | SOC 2 Type II, ISO 27001 |
| Stripe | Card payments, wallets, payment authorizations | Card data (never touched by us — via Stripe Elements) | Global | PCI-DSS Level 1, SOC 2 |
| PayPal | Alternative payments | PayPal order IDs, amounts | Global | PCI-DSS, SOC 2 |
| NOWPayments | Cryptocurrency payments | Wallet addresses, transaction IDs | EU | PCI-DSS exempt (non-card) |
| SendGrid | Transactional emails (confirmations, invoices, tracking) | Email addresses, outbound email content | US | SOC 2 Type II, ISO 27001 |
| Postmark | Inbound email reception (support tickets) | Received support emails | US | SOC 2 |
| Anthropic | Claude API for AI features (advisor, HS classification, vision) | AI prompts — no personal data persisted at Anthropic | US | SOC 2 Type II |
| Upstash | Rate limiting (Redis) | IP addresses, user IDs (short TTL) | AWS us-east-1 | SOC 2 Type II |
| Sentry | Error tracking & observability | Stack traces (PII scrubbed before send) | US / EU | SOC 2 Type II, ISO 27001 |
| Easyship | Carrier aggregator (rates, labels, tracking) | Shipment details, addresses, customs declarations | Singapore HQ | SOC 2 |
Data Handling
Data We Collect
Profile information (name, email, phone, address), shipment details (origin, destination, contents, customs declarations), payment data (via Stripe — never stored on our side), admin activity logs.
Retention
Active data retained for the lifetime of the account. After account deletion: profile and shipments removed within 30 days, invoices retained 7 years for Canadian tax compliance (CRA).
Right to Erasure
You can request account deletion at any time from Settings or by emailing privacy@mescolis.ca. We respond within 30 days per PIPEDA and GDPR.
Data Portability
Full data export available in CSV/JSON from your dashboard at Settings → Data. Includes profile, shipments, invoices, and tracking logs.
No Sale, No Ad Sharing
Your data is never sold, never shared for advertising. Period. No third-party marketing or analytics integration receives personal data.
Incident Response
In the event of a data breach or significant security incident, we commit to:
- Notify affected customers by email within 72 hours of incident confirmation
- Notify the relevant authorities (Office of the Privacy Commissioner of Canada) per PIPEDA
- Publish a detailed post-mortem on this page within 14 days of resolution
- Provide a dedicated support channel for affected customers
Incident history: No major security incidents to report to date.
Responsible Vulnerability Disclosure
We welcome reports from security researchers. If you discover a vulnerability, contact security@mescolis.ca with:
- A detailed description of the vulnerability
- Reproduction steps
- Potential impact
- Your contact for follow-up
We commit to acknowledging receipt within 2 business days, actively investigating, and coordinating public disclosure with you. We commit to not pursuing legal action against researchers acting in good faith.
Data Processing Agreement (DPA)
For customers subject to GDPR, PIPEDA, or contractual compliance requirements, we provide a standard DPA on request. Email privacy@mescolis.ca with your company name and the context of the request.
This page is updated regularly. Last updated: