Live demo Start free
Security

Security at SellersSense.

Marketplace credentials are the keys to your business. Here's how we handle them.

At a glance

  • TLS 1.2+ everywhere. HSTS preload-eligible, no plaintext fallback.
  • Per-tenant encryption keys. Marketplace API tokens are encrypted at rest with a key derived per workspace.
  • OIDC + cookie auth. Centralised on identity.evolvedsense.com with rotating signing keys.
  • API keys hashed before storage. The plaintext value is shown once at creation and never again.
  • Webhooks signed with HMAC-SHA256. Customer endpoints can verify before trusting any payload.
  • Audit log of every state change. Searchable from the admin panel for 90 days; exportable for compliance.

Infrastructure

Production runs on Oracle Cloud (Mumbai region). PostgreSQL 16 with daily logical backups, retained 30 days. OS-level disk encryption. Containers behind Caddy with automatic Let's Encrypt cert rotation. Per-service Docker isolation; postgres / redis / ollama have no public network exposure.

EU-resident customers can be moved to a Frankfurt region on Scale plans on request — same architecture, different DC.

Access controls

Production access requires a hardware-backed SSH key + bastion. Two-factor on the cloud console. Quarterly access reviews. No standing direct database access; all production reads go through the application path.

Application security

Antiforgery tokens on every state-changing form. CSP with default-src 'self'. Rate limits on the public login endpoint (10 req/min). API keys + webhook secrets are 32-byte random and never logged.

We run integration tests on every commit, including a real Postgres container so EF migration drift is caught before production. The repricing engine has hard min/max enforcement tested with cross-tenant fuzz inputs.

Compliance roadmap

  • Today: Following SOC 2 + ISO 27001 controls; not yet audited.
  • Q2 2026: SOC 2 Type 1 attestation in flight.
  • Q4 2026: Targeting SOC 2 Type 2 + ISO 27001.
  • 2027: PCI DSS scope review (we don't currently store card data — Stripe handles all PCI scope).

Responsible disclosure

Email [email protected] with a description, reproduction steps, and your impact assessment. We acknowledge within 24 hours and aim to triage within 72 hours.

Out of scope: rate-limit testing without prior authorization, social engineering of staff, denial-of-service, anything affecting other customers' workspaces. Test against your own workspace only.

We don't currently run a paid bounty program but credit researchers in a public hall of fame and keep the door open for goodwill bounties on critical findings.

Incident response

On a customer-impacting security incident we notify affected workspaces within 72 hours via the account email + a banner on the dashboard. A post-mortem is published within 14 days at sellerssense.com/incidents/<date>.

Sub-processors

Cloudflare (CDN, Turnstile), Stripe (billing), SendGrid (transactional email), Oracle Cloud (compute + storage), GitHub (source). Full list with data flow on request — email [email protected].

Found something? We want to hear about it.

[email protected]