Security

Last Updated: August 2, 2026

SellerAide is operated by Pikewood LLC. This page summarizes how we protect your account and the data you entrust to us, including any marketplace account you connect. Our internal security and data-handling policies are reviewed at least annually. We do not request or store Amazon buyer personal data.

1. Hosting & infrastructure

The application runs on Vercel (US, Oregon) with our database, authentication, and file storage on Supabase (Postgres on AWS US West 2, Oregon). Both providers maintain SOC 2 Type II / ISO 27001 attestations and encrypt data at rest. The full list of providers is on our Sub-processors page.

2. Encryption

  • In transit: TLS 1.2+ across all connections (TLS 1.3 at the edge), with HSTS.
  • At rest: AES-256 for the database and file storage.
  • Tokens: OAuth/refresh tokens for connected marketplaces and accounting integrations (including QuickBooks Online) are additionally encrypted at the application layer with AES-256-GCM, using keys held separately from the database and namespaced per provider.

3. Multi-tenant isolation

Every customer's data is isolated by Postgres Row-Level Security on every multi-tenant table. One seller can never read another seller's listings, accounting records, uploaded documents, or marketplace tokens. Backend service-role access is limited to webhooks and scheduled jobs and is logged.

4. Access control

Administrative/operator accounts require multi-factor authentication and follow least-privilege; there are no shared accounts. We perform periodic access reviews and revoke access promptly on role change or departure. Customer passwords are managed by Supabase Auth with a strong policy and lockout.

5. Secrets management

API keys and encryption keys are stored as environment secrets, never committed to source. Secret scanning runs as a pre-commit hook on staged changes and again in CI on every pull request and push to main, where it cannot be bypassed. Keys are rotated on a schedule and immediately on suspected compromise or personnel change.

6. Secure development & vulnerability management

Code lives in a private repository with a protected main branch and CI gates on every change: type-check, lint, tests, build, and secret scanning. Dependencies are monitored by automated scanning that raises security patches immediately and routine updates on a weekly cadence; we patch on a severity-based schedule (critical issues first). Static analysis runs via our linter in the same CI gate. Database migrations are append-only. We intend to commission an independent penetration test before any public app-store listing.

7. Logging & monitoring

Marketplace access audit trail. Every call we make to a connected marketplace's API on your behalf is recorded to a dedicated audit table in our database: which account's connection was used, which marketplace, the operation and endpoint, the response status, whether a person or a scheduled job initiated it, and when. These records are retained for the life of your account — well beyond the 12-month minimum we commit to — and are removed when you delete your account. They never contain request or response bodies, access tokens, or buyer data. This trail currently covers our Amazon and Etsy integrations; eBay coverage is in progress.

Application and error logging. Runtime application logs are retained by our hosting provider for a short operational window and are not a long-term record. Application errors and exceptions are captured by Sentry and retained for approximately 90 days, and we alert on authentication anomalies and error surges. All logging excludes plaintext secrets and masks OAuth tokens.

8. Incident response

We maintain a documented incident-response plan with a named contact and defined notification timelines — including notifying Amazon at security@amazon.com within 24 hours of a confirmed incident affecting Amazon data, notifying Intuit within 24 hours of a confirmed incident affecting QuickBooks data, and notifying affected individuals and regulators as required by GDPR/CCPA. Report a security concern to security@selleraide.com.

9. Marketplace & buyer data

Our Amazon Selling Partner API integration is scoped to your own catalog, listings, listing issues, listing-eligibility status, A+ Content, fee estimates, and — under the non-buyer-PII roles you authorize — your own order-financial and settlement summaries. Data retrieved through your SP-API connection is never placed in a shared or cross-seller cache. Our product-research features additionally use product-level market data from Keepa GmbH; only product identifiers are sent to Keepa — never personal, account, or seller data. We do not request or store Amazon buyer names, addresses, contact details, or payment data. The only buyer-identifying data we ever hold is the recipient name and shipping address you choose to upload in your own shipping-carrier CSV (e.g. Pirate Ship) to match postage to your orders — stored privately and per-seller, never sent to an AI provider, and never aggregated.

10. AI providers

Content you send to our AI providers (Anthropic Claude by default, Google Gemini as an alternate) is processed under paid commercial API terms; your inputs and outputs are not used to train their models. What reaches them is listing content — your own product titles, bullets, and descriptions, including listings you imported from a connected marketplace and then chose to audit, optimize, or rewrite — plus documents you upload for field extraction.

What is never sent to an AI provider: order, financial, and settlement data pulled from marketplace APIs; anything exchanged with QuickBooks; OAuth tokens; payment details; and the buyer names and addresses in a shipping file you import. See AI & Your Data for the full breakdown, including what happens to your content once it reaches a provider.

11. More

See our Sub-processors, Data Retention, and Privacy Policy. Responsible disclosure reports are welcome at security@selleraide.com.