1. Access and accountability
Serilo’s application uses individual accounts, roles, company/branch access controls, protected passwords and PINs, session controls, and supervisor approvals for selected actions. Sensitive actions are recorded in audit or repair activity records.
Access depends on the permissions configured for the shop. Administrators should give staff only the access their work requires, remove unnecessary accounts, and protect shared counter devices.
These controls reduce risk; they do not guarantee that every misuse or error will be prevented. Contact us promptly if you suspect inappropriate access.
2. Repair unlock information
The application encrypts stored repair unlock information, restricts retrieval through permissions, and records retrieval in the activity/audit trail. The active stored value is cleared when the repair is collected or cancelled.
This is not end-to-end encryption: authorised server operations can retrieve the credential for the permitted repair function. Historical backups may contain encrypted copies until expiry. Do not provide unrelated account or banking credentials.
3. Transport, backups, and recovery
The deployment configuration uses HTTPS and separates production and development databases. Development is intended to use fictional demonstration data rather than copies of customer records.
The documented deployment has daily and pre-deployment backups retained locally for 30 days. Copies held on the same server do not protect against loss of that server or account. An off-server recovery arrangement and its protections must be verified before the service is relied on for live shop records.
No uptime percentage, guaranteed restoration time, certification, or claim that all stored data is encrypted is made by this page. Any additional assurance must be supported by the actual operating arrangements and agreed plan.
4. Report an issue safely
Email serilo.app@gmail.com with the subject “Security report”. Include a concise description, affected page or function, and non-sensitive steps to reproduce it. Do not include device passcodes, customer databases, or secrets.
Do not access another shop’s information, disrupt the service, or continue testing beyond what is needed to identify the issue. Contact us to agree a safe way to provide sensitive evidence. This page does not announce a paid bug-bounty programme or grant permission for intrusive testing.
An incident affecting shop records will be assessed and communicated under the applicable law and accepted agreement. Provider, retention, and response arrangements remain part of the launch review.