Security & Data Protection

Thermisight Dynamics LLC takes the protection of customer data — names, addresses, phone numbers, and email addresses — seriously. The domains thermisightdynamics.com, thermisighthunters.com, thermisightindustrial.com, and thermisightdrone.com are owned and operated by Thermisight Dynamics LLC, and this page describes the technical and administrative controls we rely on to keep customer data secure both in transit and at rest across all four sites.

Encryption in transit

All traffic between your device and thermisightdynamics.com is encrypted with TLS (Transport Layer Security). Every page and API request is served exclusively over HTTPS, and plain HTTP connections are redirected to the secure channel. Payment details never touch our servers — they are entered directly into Shopify's PCI-DSS-compliant checkout, which encrypts card data end-to-end.

Encryption at rest

Customer data is stored in our managed database, which is encrypted at rest. Backups are encrypted and access to the data store is restricted to authenticated, authorized services. In addition, the most sensitive personally identifiable information — order shipping details and the government, service, or badge identifiers submitted for eligible-pricing verification — is protected with field-level AES-256-GCM encryption before it is ever written to the database, so the values are unreadable even if the underlying store were compromised. Decryption is performed only by admin-authenticated services for fulfillment and review.

Access control

Data access is governed by row-level security. Customers can see and manage only their own orders, returns, and verifications. Administrative data — order routing, fulfillment status, manufacturer contacts, discount codes, verifications, and returns — is restricted to signed-in admin accounts. Public, unauthenticated visitors can browse the catalog but cannot read any customer record.

Data minimization

We collect only what is needed to process orders and verify eligibility: name, shipping address, email, and phone for fulfillment; and a service or badge identifier for military, law-enforcement, and first-responder pricing. We do not store payment card numbers — Shopify tokenizes and holds card data on our behalf.

Verification data

Government, service, or badge identifiers submitted for eligible-pricing verification are stored solely to confirm eligibility and are visible only to admin reviewers. Verification status (not the underlying identifier) is what unlocks pricing on your device.

Account security

User accounts are authenticated by the platform's managed auth service, which handles password hashing, session tokens, and email verification. Keep your credentials secure; you are responsible for activity under your account. Contact us immediately if you suspect unauthorized access.

Vendor controls

Thermal optics ship directly from authorized manufacturers, who receive only the order and ship-to details required to fulfill your order. Manufacturers are contractually bound by their own dealer and privacy terms. We do not sell or rent customer data to third parties. Manufacturer partners access the partner portal under brand-scoped row-level security — each partner can see only their own brand's orders, products, and customer ship-to details. No partner can access another brand's data, and no partner can access customer PII beyond what is needed for fulfillment.

Denied-party screening

Every dealer application, order, and B2B quote request is screened against cached U.S. denied-party lists — including the Treasury OFAC Specially Designated Nationals (SDN) list and aliases, the Commerce Bureau of Industry and Security (BIS) Denied Persons List, and the State Department Debarred Parties list — using local file-based name matching with no per-query cost. The list cache refreshes daily via an automated workflow. Potential matches are flagged for human verification before any order proceeds, and embargoed-country checks screen addresses against EAR Part 746 restricted regions. No order ships to a matched or restricted party.

External AI access (MCP)

An MCP (Model Context Protocol) server exposes product catalog and order-status data to external AI assistants via OAuth-authenticated tool calls. The MCP server exposes only product specifications and order status (by unguessable tracking token) — no customer PII, no account data, and no payment information is accessible through the MCP server. Access is rate-limited and logged.

Export & U.S. export controls

Thermal imaging devices may be subject to U.S. export controls including ITAR and EAR. We sell and ship within the United States in accordance with each manufacturer's export restrictions. See our Terms of Service for the end-user representation.

Operational Monitoring

We operate a Statistical Process Control (SPC) dashboard that applies ±3σ control limits and Nelson-rule violation detection across five operational data streams — stock levels, manufacturer satisfaction, order volume, MAP compliance actions, and competitor price changes. This monitoring uses aggregated, de-identified operational metrics only — no customer PII is processed or displayed — and helps us detect process drift (inventory sync errors, compliance degradation, pricing anomalies) before they affect customers, so we can intervene proactively rather than reactively.

Breach Response & Notification

In the event of unauthorized access to personal information, we will investigate promptly, contain the incident, and notify affected customers and the Oregon Attorney General as required by ORS 646A.604 and other applicable state breach-notification statutes, without unreasonable delay and consistent with the needs of any law-enforcement investigation.

Vulnerability Reporting

If you believe you have identified a security vulnerability on thermisightdynamics.com, please report it responsibly to jamesmcgee@thermisightdynamics.com with details sufficient to reproduce it. We ask that you refrain from exploiting the issue or accessing customer data, and we will acknowledge credible reports promptly.