Policies & Terms Policy

Security Policy for Module Development

Our security practices, data handling policies, and commitment to protecting your store when using mypresta.rocks modules and services.

Security Policy

Last updated: 15.02.2026

1. Module security standards

All modules follow these practices:

  • Input validation: All user inputs are validated and sanitised to prevent SQL injection, XSS, and other common attack vectors.
  • PrestaShop security framework: We use PrestaShop's built-in security functions -- pSQL(), Validate class methods, CSRF token verification, and proper escaping.
  • No external calls without purpose: Modules do not make unauthorised external HTTP requests. Any outbound connections (licence verification, update checks) are documented and serve a specific purpose.
  • No backdoors: No hidden access points, no obfuscated code, no undisclosed data collection.
  • Minimal permissions: Modules request only the database tables, hooks, and permissions they need to function.
  • Active maintenance: We release security patches when vulnerabilities are discovered.

2. Data we do NOT access

When interacting with your store (remote support, debugging, module configuration), we do not access, collect, process, or store:

  • Customer personal data (names, emails, phone numbers, addresses)
  • Payment information (credit card numbers, bank details, transaction records)
  • Customer passwords or authentication credentials
  • Order contents or purchase history of individual customers
  • Any data classified as personal data under GDPR, CCPA, or equivalent regulations

3. Data we MAY access

When providing support, the only information we may access is store configuration data:

  • PrestaShop version and PHP version
  • Module list and version numbers
  • Theme name and configuration
  • Server environment details (web server type, MySQL version, memory limits)
  • Store settings relevant to module functionality (multi-store config, currency, language settings)
  • Module-specific configuration values
  • Error logs and debug output related to module operation
  • Database table structure (schema) for our modules -- not the data in customer/order tables

This information is used to diagnose issues, provide support, and ensure compatibility. It is not shared with third parties, not used for marketing, and not retained beyond the support interaction unless needed for ongoing case resolution.

4. Remote access and support sessions

If you grant us access to your back office or server for support:

  • Access is used solely for the stated support purpose
  • We recommend creating a dedicated temporary employee account with limited permissions
  • We recommend revoking access (delete the account or change credentials) after the session
  • We do not retain your access credentials after the session
  • We will not access areas of your store unrelated to the support request
  • Any changes made during the session will be communicated to you

5. Demo and trial environments

For our on-demand demo shops (mypresta.rocks/demos):

  • Demo environments are isolated and temporary
  • No real customer data is present in demo stores
  • Demo shops may be monitored for abuse prevention
  • Data entered into demo shops is not backed up and may be deleted at any time
  • See our On-Demand Demo Shop Terms for full details

6. Licence verification

Some modules include a licence verification mechanism that transmits:

  • Your store's domain name
  • The module version installed
  • The licence key

This is used only to verify licence validity. No other data is collected through this mechanism.

7. Vulnerability reporting

If you discover a security vulnerability in any of our modules, report it to contact@mypresta.rocks. We will:

  • Acknowledge receipt within 24 hours
  • Investigate and assess severity
  • Develop and release a patch
  • Notify affected customers if the vulnerability poses significant risk

We appreciate responsible disclosure and ask that you do not share vulnerability details publicly until a fix is available.

8. Third-party services

Our modules do not integrate with third-party analytics, tracking, or advertising services unless stated in the module description. Where a module integrates with an external service (shipping carrier API, payment gateway), this is documented and requires your explicit configuration.

9. Your responsibilities

  • Keep your PrestaShop installation and all modules updated
  • Use strong passwords for all back office accounts
  • Maintain regular backups
  • Review and configure module settings appropriately for your environment
  • Test modules in a staging environment before deploying to production
  • Revoke any temporary access granted for support

10. Contact

Security-related questions: contact@mypresta.rocks.

Back to top