Data protection & security

1. Scope of Amazon data & minimization

Sellcast requests the Inventory and Order Tracking and Amazon Fulfillment roles only. It reads seller catalogue and listings, FBA inventory summaries and inbound shipments, and orders at an aggregate level (SKU, quantity ordered, order total, and dates). Sellcast does not request or store buyer personally identifiable information (PII) — no buyer name, email, shipping or billing address, or phone — and does not request PII/restricted roles. Forecasting uses order quantities and values, not buyer identity.

2. Purpose limitation

Amazon Information is used solely to provide the demand-planning service to the seller who authorized it. It is never shared with, sold to, or disclosed to any third party, never used for advertising, never used to train shared or third-party models, and never combined with another seller’s data.

3. Encryption

In transit: all traffic — browser to app, app to Amazon SP-API, and app to database — uses TLS. At rest: the LWA refresh token for each seller connection is encrypted with AES-256-GCM (a random 12-byte IV, auth tag verified on decrypt) before it is written to the database. The encryption key is held only in the server runtime environment, is never in source control, and is distinct per environment. SP-API access tokens are short-lived and minted per request from the encrypted refresh token; they are held in memory only. Account passwords are hashed with bcrypt and are never stored reversibly.

4. Credential & token management

Only the connector code paths that need a token can decrypt it. The plaintext token is never returned to the client, written to logs, or exposed in any API response. When a seller disconnects, the stored credentials are revoked and deleted.

5. Access control & tenant isolation

Multi-tenant data is isolated per organization: every query is scoped by organization id, so one customer cannot read another’s Amazon data. Application access is role-gated (owner / admin / member) where applicable. Human and operator access to production data is limited to what is required to operate the service and is not used for any secondary purpose.

6. Network & infrastructure

Sellcast runs on a managed cloud platform. The database, cache, and internal forecasting service sit on a private network and are not exposed to the public internet. The public application is the only internet-facing surface; it enforces HTTPS, security response headers (HSTS, X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy), and rate limiting on authentication endpoints. Server-side outbound calls are restricted to validated hosts (the SP-API endpoints and known subprocessors); no user-controlled URL is fetched server-side.

7. Logging & monitoring

Application and job logs record operational events — sync started or failed, connection status — and never contain secrets or buyer data. Within the app, every draft, edit, and approval is written to a user-visible audit log.

8. Incident response

We maintain a documented incident-response plan. A suspected credential or data exposure triggers rotation of the affected secrets, revocation of affected sessions and tokens, and notification of affected customers as required. For a confirmed security incident affecting Amazon Information, we will notify Amazon within 24 hours via the channel Amazon designates. Report a concern to security@sellcast.ai.

9. Vulnerability & patch management

We run supported, actively patched software and dependencies, keep production infrastructure current with security updates, and address known vulnerabilities on a risk-prioritized basis.

10. Retention & deletion

Amazon data is retained only while the seller’s connection is active. On disconnect, the stored credentials are revoked and deleted, and associated data is removed within 90 days. On account closure or a deletion request, the account’s data is deleted, except where a longer period is required by law. You can export your data at any time.

11. Subprocessors

Amazon Information is not shared with, sold to, or disclosed to any third party. It is stored only within Sellcast’s own managed cloud hosting infrastructure. The providers below support the Sellcast service generally, each contractually bound to protect data and use it only on our instructions; the email, payment, and error-monitoring providers never receive Amazon Information:

• Cloud hosting & database — [[ CONFIRM: provider & region, e.g. “Render, US” ]]
• Transactional & product email — [[ CONFIRM: email provider ]]
• Payment processing — [[ CONFIRM: payment processor ]]
• Error monitoring / logging — [[ CONFIRM: provider, or “none” ]]

12. Governance

Access to production secrets and data is limited to the operating team on a need-to-use basis. Secrets are managed through the platform’s encrypted environment configuration, not in code or shared documents. Sellcast is in early access: this page describes the practices we hold, not certifications we haven’t earned. We follow SOC 2-aligned practices but are not yet certified, and will update this page as we formalize them.

Contact

Security and data-protection matters: security@sellcast.ai.