Security principles

Insimen Market is designed around least-privilege access, protection by design, and limiting impact when an issue occurs. No digital system is risk-free, so controls are reviewed and improved as the product evolves.

Product controls

Controls are applied in proportion to the feature and its risk.

• server-side access checks for relevant accounts, stores, orders, and payment data
• input validation, request limits, and audit records for important activity
• separation of secret configuration from the public application and secure session handling
• access limits so order data is available only to the buyer, seller, and relevant operations staff

Your role

Keep your account and devices secure.

• Use a unique password and never share it.
• Enable available account verification methods.
• Do not send passwords, one-time codes, tokens, or other secrets through regular messages.
• keep your account, devices, and credentials secure
• provide accurate purchase, address, store, product, and instruction information
• comply with applicable laws, intellectual-property rights, and trading and delivery requirements

Sensitive access and changes

Sensitive changes are checked server-side. Relevant activity may be recorded to support security, abuse prevention, and incident investigation.

Incident reporting

If you suspect unauthorized access, change your password, sign out of unrecognized sessions, and contact us. Do not include passwords, one-time codes, or unnecessary private content in a report.

Important limit

Insimen Market provides a service for buyers and sellers to connect and supports transaction flows. Product availability, quality, safety, legality, delivery, and fitness remain the seller's responsibility under applicable law unless stated otherwise in writing.

Shared security responsibilities

Insimen applies controls appropriate to context and risk, including authority checks, session protection, validation and restricted access to sensitive data. Controls are reviewed as services change; this description does not certify every integration or promise identical controls everywhere.

Use a unique password, device protection and available additional verification. Check domains, recipients and permission requests before sharing data. Support does not request passwords, PINs, one-time codes, private keys or recovery codes. Organisation owners should review members and remove obsolete access.

Reporting, evidence and recovery

Report suspected account takeover, unauthorised data access or transaction errors to cs@insimen.com with the service, incident time and a safe description. Do not exploit an issue, access others’ data, publish secrets or send unnecessary sensitive samples.

Insimen may verify ownership, restrict risky sessions or features and review relevant records. Recovery depends on findings and the incident; a report alone does not guarantee recovery of all data or funds. Actions remain subject to statutory duties and user rights.

Products, sellers, delivery and returns

Use official checkout and order references. Verify changed payment instructions before acting; do not pay again merely because a message claims to be a seller or support. Report store takeovers, fictitious shipments, illegal goods and requests for one-time codes.