We take security seriously. Here's exactly how we protect your marketplace credentials, business data, and customer information.
Multiple layers of security protect every piece of information you entrust to us.
All marketplace API credentials are encrypted with AES-256-GCM before storage. Even if someone accesses our database, your keys are unreadable.
Industry-standard encryption used by banks and governments worldwide.
Authentication is handled by Supabase with JSON Web Tokens. Your session is validated on every request — no stored passwords, no cookie tampering.
Same auth infrastructure used by thousands of production apps.
Admin operations use a service-role key that never leaves the server. No admin data is exposed to the browser. All admin actions are logged for audit.
Complete separation between user and admin access.
Every API endpoint independently validates your identity. There's no single point of failure — each request must prove who you are.
Zero trust architecture. Every request is verified.
Supabase RLS policies ensure you can only ever see and modify your own workspace data. Even direct database queries are filtered by your identity.
Database-enforced isolation between all sellers.
Every admin action, every support ticket, every connection change is logged with timestamps and user IDs. Full accountability.
Complete history of who did what and when.
Marketplace OAuth tokens are stored in separate tables with encrypted fields. Tokens are refreshed automatically and revoked on disconnect.
Tokens are never exposed to the client side.
Your login session refreshes automatically. No sudden logouts while you're working. Sessions are invalidated on logout.
Seamless experience with secure session management.
The principles we follow to keep your business safe.
API keys and secrets are encrypted server-side before storage. Our team cannot access them.
Row-Level Security ensures no seller can ever see another seller's orders, inventory, or financial data.
Three admin roles (super_admin, support, analyst) with minimum-privilege access. Every action is logged.
We don't sell your data or share it with advertisers. Your business data is yours alone.
All data is transmitted over HTTPS/TLS. Sensitive fields are encrypted in the database.
We regularly audit our code, dependencies, and infrastructure for vulnerabilities.
We're happy to discuss our security practices in detail. Reach out anytime.