Security
Account protection
SellerEngine accounts use email verification, mandatory two-step verification (TOTP) for every non-demo user, and short-lived pre-auth challenges that are signed to prevent tampering. Passwords are stored only as salted PBKDF2 hashes — never in plain text. Sign-in, verification and other sensitive endpoints are rate-limited. Repeated wrong passwords pause sign-in for a while and the account holder is emailed; repeated failed verifications lock the account until the password is reset. Sessions use secure, HTTP-only cookies with idle-timeout enforcement.
Workspace & data isolation
Every registered user has a private, partitioned workspace. Each record is scoped to its owner so that no other customer — and no other workspace — can read it. Demo accounts are fully isolated, reset on sign out and never call Amazon connections. Production apps stay empty until you connect Amazon and complete the first sync.
Data protection
Connections use TLS. Amazon refresh tokens and selected authentication secrets receive application-layer encryption. Backup contents are separately encrypted before replication to the off-provider store. Sensitive endpoints require an authenticated session. Security events are recorded in audit tables with retention controls; these tables are not a tamper-proof, immutable ledger.
Application security
Database access uses parameterised queries to prevent injection, dynamic output is escaped to prevent cross-site scripting, and exported files are sanitised against spreadsheet formula injection. A restrictive Content Security Policy and hardened HTTP response headers are enforced at the edge. Internal service-to-service calls between our edge and compute layers are authenticated with rotating HMAC signatures.
Backups & disaster recovery
SellerEngine creates encrypted backup copies and replicates them to a separate provider in an EU region. The off-provider copies use additional application-layer encryption. Backup retention and deletion vary by data category and lifecycle rule; these copies are not described as an immutable or universally append-only archive. Provider locations and data-processing limits are described in the Privacy Policy.
Data residency & compliance
Our backend is hosted in Germany and the off-provider backup store uses an EU region. Cloudflare operates a global edge network. AI and other service providers can process limited data outside the EEA. There is no blanket EU-only processing guarantee. See the AI features and data-use disclosure and the provider information.
Customer controls
From your account's danger zone you can export your data or delete your account permanently. Both actions require a valid authenticator code. The export is delivered as a download link valid for 24 hours that only opens while you are signed in to your account. Deletion, backup expiry and retained security or legal records are different processes. We do not claim that account deletion immediately erases every provider-held copy, including already delivered emails. See account deletion for the published scope and contact [email protected] to request clarification or provider follow-up.
Responsible disclosure
For security questions or vulnerability reports, contact [email protected]. Our security contact is also published at /.well-known/security.txt. We appreciate coordinated disclosure and will work with you to verify and resolve valid reports.