Security
Security built into every layer
Sellers and agencies trust SellerSyd with their business data. Here's how we protect it, in plain language.
Data protection
Your data is encrypted and isolated
Encryption in transit
All traffic uses HTTPS (TLS 1.2+), with HSTS so browsers never fall back to an insecure connection.
Encryption at rest
Marketplace access tokens and two-factor secrets are encrypted with AES-256-GCM. Databases and backups are encrypted by our hosting provider.
Account isolation
Every request is checked against the accounts the signed-in user may access, so one customer can never see another's data.
Official authorization
Stores are connected through the marketplace's own sign-in (for Amazon, Seller Central authorization). We never ask for or store your marketplace password.
Minimal personal data
SellerSyd is built around business data. We don't request access to buyers' personal information such as names and addresses.
Audit trail
Sign-ins, permission changes, connections and other sensitive actions are recorded in an audit log.
Access control
The right people, the right data
Two-factor sign-in
Authenticator-app two-factor authentication with single-use recovery codes, available to every user.
Strong credentials
Passwords are hashed with bcrypt, sign-in attempts are rate-limited, and sessions use long random tokens stored only as hashes.
Least privilege
Owners choose exactly which accounts and modules each team member can view or edit.
Verified accounts
Email verification is required before a store can be connected.
Hardened web app
Strict security headers, protection against clickjacking and cross-site attacks, and dependency vulnerability monitoring.
Reliable operations
Automated backups, monitored infrastructure and a documented incident response process.
Report a vulnerability
If you believe you've found a security issue, please email security@sellersyd.com with the details. We'll acknowledge your report promptly and keep you updated. Please don't access other customers' data or disrupt the service while testing.
Questions about security or a security review for your organization? Contact us.