Security

Your sales and profit data is sensitive. This is how we protect it.

Draft under review. This page is not legal advice and may change before launch. Last updated: 11 October 2026.

Signing in

Passwords of at least 12 characters, stored as one-way bcrypt hashes
Temporary lock after 10 wrong attempts
Two-step sign-in with an authenticator app and single-use recovery codes
The session cookie is HttpOnly, rotates on use and is revoked if a copy is detected
Changing or resetting the password signs out your other devices

Your data

Encryption in transit with TLS 1.2 or newer; encrypted server disk
Amazon access keys and two-step secrets are encrypted again inside the application (AES-256-GCM)
Every request is checked so you see only your own workspace; automated tests try to cross workspaces and must fail
No buyer personal data is stored
Logs contain no passwords or access keys
Daily server snapshots, kept 7 days

Access to Amazon

You approve on Amazon's own page; we never see your Amazon password
The connection request is bound to the browser and user that started it
Read-only toward Amazon
Disconnecting deletes the access keys at once
Amazon Ads (when Amazon approves our access): read-only reports, the access key encrypted the same way, never shared with the AI assistants. See the Amazon Ads Data Policy.

Operations (beta environment)

One server on Amazon Web Services; the database and cache are not exposed to the internet
Secrets live in a managed secrets store, not in code
Support can open your account only if you allow it: read-only, time-limited, e-mailed to you and logged
A downloadable activity log of sign-ins and changes

What we do not have yet
No independent penetration test and no certification such as SOC 2 or ISO 27001. No multi-server production setup with automatic failover yet, and no tested restore drill. We will publish each of these here when it exists.

Report a vulnerability

Write to info@sellergrid.co. Please do not access other people's data or disrupt the service while testing.