Security Policy

This Security Policy describes the technical and organisational measures Roaminix Shop (“Roaminix”, “we”, “us”) implements to protect your data, your payments and our infrastructure. Security is fundamental to a service that handles personal data and payments for customers in more than 200 countries. This Policy complements our Privacy Policy.

1. Our Commitment to Security

We treat the security of customer data and transactions as a priority. We follow a risk-based approach, applying controls proportionate to the sensitivity of the data and the risks involved. Our measures are reviewed and updated regularly in line with industry best practice and evolving threats. While no system can be made completely secure, we are committed to continuously improving our defences.

2. Encryption in Transit & at Rest

In transit. All data exchanged between your browser and our website is protected using TLS (HTTPS) encryption, which prevents eavesdropping and tampering over the network.
At rest. Sensitive personal data and credentials stored in our systems are encrypted or protected using strong hashing (for example, passwords are stored as salted hashes, never in plain text).
Key management. Encryption keys are managed with access restricted to authorised personnel and rotated according to our key-management procedures.

3. Payment Security

Payments are processed by reputable, PCI-DSS-compliant third-party payment providers. We do not store full credit or debit card numbers on our servers; card data is handled directly by the payment provider over encrypted channels. We follow the principles of the Payment Card Industry Data Security Standard (PCI DSS) to the extent applicable to our role as a merchant, and we restrict access to any payment-related information to authorised staff on a need-to-know basis.

4. Account Protection

Passwords are stored using strong, salted one-way hashing and are never stored or transmitted in plain text.
We enforce access controls so that only authorised personnel can access customer data, and access is logged.
We support secure session handling, including session timeouts and protection against common web attacks such as cross-site request forgery (CSRF) and cross-site scripting (XSS).
Where available, we encourage customers to use strong, unique passwords and to keep their login details confidential.

5. Data Handling & Storage

We collect and store only the data necessary to provide our services, in line with our Privacy Policy.
Access to production data is restricted, monitored and logged; bulk access requires authorisation.
We apply data-minimisation and retention limits, deleting or anonymising data when it is no longer needed.
Backups are encrypted and access-controlled to protect against data loss while preserving confidentiality.

6. Network & Infrastructure Security

Our infrastructure is hosted with reputable providers that implement physical, network and environmental security controls.
We use firewalls, intrusion detection/prevention and network segmentation to isolate and protect systems.
Software and dependencies are kept up to date, and security patches are applied promptly.
We perform regular vulnerability scanning and, where appropriate, third-party security assessments.

7. Incident Response

We maintain procedures to detect, respond to and recover from security incidents. In the event of a confirmed personal-data breach that is likely to result in a risk to your rights and freedoms, we will take steps to contain and remediate the incident and, where required by law, notify the relevant data-protection authority and affected individuals. If we become aware of a security issue affecting your account, we will notify you and provide guidance on protective steps (such as changing your password).

8. Vulnerability Disclosure

We welcome security researchers and customers who discover a potential vulnerability in our systems. Please report it responsibly and in good faith to [email protected], describing the issue and any reproduction steps. We ask that you do not exploit the vulnerability, access data beyond what is necessary to demonstrate the issue, or disclose it publicly before we have had a reasonable opportunity to address it. We aim to acknowledge and investigate valid reports promptly.

9. Your Role in Staying Secure

Security is a shared responsibility. To help protect yourself and your account, we recommend that you:

Use a strong, unique password for your Roaminix account and do not reuse it elsewhere.
Keep your delivery email and activation details safe; treat them as sensitive.
Only activate your eSIM on devices you trust and that you own or control.
Be cautious of phishing emails or messages impersonating Roaminix; we will never ask for your full card number or password by email.
Report any suspicious activity or suspected breach to us immediately.

10. Contact

For security questions, incident reports or vulnerability disclosures, contact us at [email protected] or call +84 903 749 682. Roaminix Shop, 33B Do Xuan Hop, Binh Trung, Ho Chi Minh City, Vietnam.

Last updated: September 2026

Policy