Information Security Policy

This Information Security Policy describes the administrative, technical, and physical safeguards implemented by WEB3 TREK, INC., operator of TrekO.ai, to protect company systems, customer information, marketplace integrations, payment processing, digital assets, and confidential business data.

1. Purpose

The purpose of this policy is to protect the confidentiality, integrity, and availability of information processed, stored, or transmitted through TrekO.ai while supporting secure marketplace integrations, payment processing, and cloud-based services.

2. Scope

This policy applies to all employees, contractors, administrators, cloud infrastructure, software applications, APIs, databases, and third-party integrations operated by WEB3 TREK, INC. in support of TrekO.ai, including:

• TrekO.ai Marketplace
• Firebase Authentication and Firestore
• Render cloud infrastructure
• Stripe payment services
• PayPal payment services
• Amazon Selling Partner API (SP-API)
• TikTok Shop APIs
• Meta / Facebook APIs
• Shopify
• eBay
• Etsy
• Other approved marketplace integrations

3. Security Objectives

WEB3 TREK, INC. maintains security controls designed to:

• Protect customer information.
• Protect seller information.
• Prevent unauthorized access.
• Protect confidential business information.
• Maintain service availability.
• Reduce cybersecurity risks.
• Support compliance with marketplace security requirements.

4. Access Control

Access to systems and customer information is restricted to authorized personnel with a legitimate business need.

• User authentication is required.
• Administrative access is limited.
• Role-based permissions are used whenever practical.
• Access privileges are reviewed periodically.

5. Authentication Requirements

WEB3 TREK, INC. requires strong authentication practices, including:

• Strong passwords.
• Multi-Factor Authentication (MFA) where supported.
• Secure password management.
• Prompt removal of unnecessary accounts.

6. Credential Management

API keys, OAuth tokens, access credentials, encryption keys, and application secrets are stored securely using protected environment variables or approved secure storage mechanisms.

Credentials are never intentionally stored in public repositories, embedded in client-side code, or exposed to unauthorized users.

7. Data Encryption

Sensitive information is protected using industry-standard encryption during transmission.

• HTTPS/TLS is required for all external communications.
• Secure API connections are used for marketplace integrations.
• Encrypted communication is required for cloud services whenever available.

8. Cloud Infrastructure Security

Production services operate on managed cloud infrastructure that provides security monitoring, redundancy, infrastructure updates, and availability protections. Cloud service providers may include Firebase, Render, Stripe, PayPal, and other approved providers.

9. Logging and Monitoring

System activity, authentication events, API requests, payment events, and operational errors are logged to assist with:

• Security monitoring.
• Troubleshooting.
• Fraud detection.
• Incident investigations.
• Operational reliability.

10. Third-Party Integrations

Marketplace integrations are performed only through authorized APIs and approved service providers.

Customer authorization is required before accessing third-party marketplace accounts or marketplace data.

11. Data Protection

Customer and seller information is collected only as necessary to provide requested marketplace services.

• Data access is restricted.
• Information is retained only as long as necessary.
• Information is protected against unauthorized disclosure.
• Security controls are continuously reviewed and improved.

12. Security Awareness

WEB3 TREK, INC. periodically reviews security practices, system configurations, authentication controls, infrastructure settings, and operational procedures to reduce cybersecurity risks and improve platform security.

13. Policy Review

This Information Security Policy is reviewed at least once every six (6) months and updated whenever significant operational, technical, security, or regulatory changes occur.

14. Compliance

WEB3 TREK, INC. maintains information security practices designed to support the requirements of major marketplace platforms, payment providers, cloud service providers, and applicable industry standards, including the Amazon Selling Partner API Data Protection Policy.

15. Contact

Questions regarding this Information Security Policy may be directed to:

WEB3 TREK, INC.
Email: support@treko.ai
Website: https://treko.ai