1. Section Scope & Legal Intent
2. Mandatory Standards & Operating Requirements
All participants subject to this policy must strictly adhere to the following mandatory standards:
- All sensitive credentials, API secrets, and financial tokens must be stored using cryptographic salting and enterprise hardware security modules (HSM).
- In the event of a verified data compromise, ePaisay will notify affected regulatory supervisory authorities within 72 hours of discovery.
- Users impacted by a high-risk security breach will receive direct emergency notifications detailing mitigation measures.
3. Explicit Prohibitions & Violation Triggers
The following actions constitute direct non-compliance and trigger automatic intervention by the Warning and Violation System:
- Failing to immediately report a suspected merchant-side credential compromise or compromised API token to platform security.
- Storing raw, unencrypted buyer credit card data or passwords in local seller databases.
- Obstructing a forensic investigation conducted by the platform Incident Response Team.
4. Warning & Violation System Enforcement Matrix
Each violation under this section is mapped directly to the automated warning and sanction ladder:
| Violation Code | Offense Description | Detection Method | Severity Tier | Cure Window | Mandatory Sanction |
|---|---|---|---|---|---|
VIOL-315-01 |
Failure by merchant to disclose a verified breach of local customer data within 24h. | Security Telemetry / Threat Intel Feed | Tier 4 (Critical) | Immediate | Permanent termination of merchant privileges, total indemnification claim. |
VIOL-315-02 |
Unsafe storage of customer fulfillment records on public cloud buckets. | External Security Research Report | Tier 3 (High) | 6 Hours | Immediate API suspension, 3 Strike Points, mandatory security audit. |
VIOL-315-03 |
Delayed response to security vulnerability assessment questionnaire. | Enterprise Compliance Scan | Tier 1 (Advisory) | 48 Hours | Temporary reduction in daily API request rate limits. |
5. Platform Safe Harbor & Limitation of Liability
Platform Intermediary Status: ePaisay provides the technological marketplace venue connecting independent counterparties. ePaisay is not a vendor, retailer, agent, or guarantor of any product, service, or transaction governed herein.
Total Disclaimer of Warranties: The platform disclaims all warranties of merchantability, fitness for particular purpose, and non-infringement to the fullest extent permissible by applicable law.
Limitation of Damages: In no event shall ePaisay, its officers, directors, or employees be liable for incidental, indirect, punitive, or consequential damages. Aggregate liability is strictly capped at the lesser of $100 USD or platform fees paid in the preceding three months.
Participant Indemnification: The participant agrees to defend, indemnify, and hold harmless ePaisay against any third-party claims, regulatory penalties, legal fees, or damages arising out of violations of this Section.