Security

SellerCopilot connects to your Amazon seller account and analyses your business data. This page describes, in plain terms, how that data is protected, what we deliberately choose not to store, and what happens when you leave. It is written to be read by your security or compliance team as much as by you.

We describe only controls that are in place today. Where something is a limitation, we say so rather than leaving it out.

The buyer data we do not store

The most reliable way to protect personal data is not to hold it. SellerCopilot stores no buyer email addresses, no buyer names, no phone numbers and no street addresses.

Our repeat-purchase and customer-value analytics need to recognise that two orders came from the same customer. They do not need to know who that customer is. So when an order report arrives, the first street line of the ship-to address is read in memory, combined with the city, state or province, postal code and country, and turned into a digest. The digest is stored and the street line is not. The same address always produces the same digest, which is what links a customer's orders together.

Alongside the hash, each order line keeps the ship-to city, state or province, postal code and country. They are used for repeat-purchase analysis and geographic breakdowns within the seller's own account.

Encryption

• In transit. Every connection to the application and to the marketing site is served over HTTPS/TLS. Plain HTTP requests are redirected to HTTPS.
• Amazon credentials at rest. The refresh tokens and client secrets that authorise access to your Amazon accounts are encrypted with AES-256-GCM before they are written to the database. The encryption key is held as a server environment secret, separate from the database itself, so a copy of the database alone does not yield usable Amazon credentials.
• Database at rest. Your data is held in a managed PostgreSQL service that encrypts data at rest, including backups, and supports point-in-time recovery.
• Passwords. Account passwords are never stored. We keep only a bcrypt hash with a per-password salt.

Where your data lives

The application runs on Railway in the United States (US East) and the production database on Neon, also in the United States (us-east-2). Requests reach the application through Cloudflare's network, which terminates the encrypted connection at the location nearest the visitor before forwarding it. We do not replicate your data to other regions and we do not sell, rent, or share it with third parties for their own purposes.

Account isolation

Every record belonging to your business carries your company identifier, and every query the application makes for a customer is scoped to that customer's company. You see your data and nothing else.

To be precise about how that is enforced, there are two layers. The application scopes every query to the signed-in user's company and Amazon account. Underneath that, the database enforces row-level security: requests made for a signed-in customer run as a database role that cannot bypass it, with that customer's company and account set, so a query that forgot its filter would still return only that account's rows. A separate administrative connection is used for sign-in and account security, billing, saving Amazon credentials, looking up which company and Amazon accounts a user belongs to, finding the accounts that scheduled jobs run for, AI usage accounting and SellerCopilot staff tools, among them a staff-only comparison of recommendation outcomes across customers; that connection is not restricted by row-level security. The same mechanism keeps each of your own Amazon marketplaces separate from the others.

Access and authentication

• Sessions are stored server-side. Session cookies are HTTP-only and restricted to HTTPS. A session ends after 24 hours without activity and after seven days in any case.
• A new customer can sign up on their own; the account cannot be used until the email address is confirmed through a link sent to it. Additional users can be added to a customer's account by the SellerCopilot team, who send them an invitation link. Password-reset links expire after one hour and invitation links after seven days; both are single-use.
• Passwords must be at least 12 characters with upper and lower case letters, a number and a symbol, cannot contain the user's name or email, cannot repeat any of the last ten, and must be changed after a year. Repeated failed sign-ins are rate-limited.
• Two-factor authentication with an authenticator app is required for SellerCopilot staff accounts with administrative access. For customer accounts it is available but optional, and can be turned on from Settings.
• Each user can be restricted to a subset of pages, on request, so a team member can have the inventory view without giving them financial data.
• Access to production systems is limited to the people who operate the service.

How AI features handle your data

SellerCopilot uses Anthropic's Claude models to generate written reports, to explain a recommendation when asked, to summarise the monthly recommendation scorecard (totals only, no product names), and to answer questions in the assistant. Four things are worth knowing:

• Your data is not used to train models. We send data to Anthropic's API, which excludes API inputs and outputs from model training.
• Written reports anonymise product names. The operations report and the sales dashboard insights replace product names with neutral placeholders before the request is sent, and restore them in the response. The executive summary sends only totals and unnamed product lines. The explanation on a recommendation card calls the product "this product" instead of naming it, but it does include the account notes your team keeps in SellerCopilot, such as brand name, key products and competitors.
• The assistant sends product identifiers. To answer questions about specific products, the assistant sends product identifiers (ASINs and SKUs), product titles, the related figures and the account notes your team keeps in SellerCopilot with each question. It never sends buyer identities: order and customer information reaches it only as totals (counts, units and revenue), which can be broken down by product and by ship-to state or country.
• The assistant can only read. It answers from a fixed set of read-only queries that are locked to your company and account on the server. It cannot write, delete, or run free-form database commands, and it cannot reach another customer's data.

Amazon data handling

We request only the data categories needed for the analytics described on this site, and we handle data obtained through Amazon's APIs in accordance with Amazon's Acceptable Use Policy and Data Protection Policy. You can revoke SellerCopilot's access from within Amazon Seller Central at any time, and its advertising access from the Amazon account that granted it. After revocation, Amazon no longer returns data to us under that authorization. If you revoke the Seller Central authorization, we notice the next time we request data from Amazon and Amazon refuses: no new collection starts for that Amazon account, and our team deletes the data collected from it within 30 days of noticing, unless you reconnect it first. Removing the Seller Central connection in SellerCopilot's settings has the same effect. Revoking or removing only the advertising access stops advertising collection but does not by itself delete stored data: tell us and we will delete it.

Deletion

Deletion is carried out by the SellerCopilot team, not automatically. When a customer asks us to delete their account, or within the 30-day retention period that follows the end of a subscription or of a trial without a payment method, we delete the company record and all of its associated data — sales, advertising, inventory, orders, financial transactions, reports and recommendations — from the production database. When a Seller Central authorization is revoked, the data collected for that Amazon account is deleted within 30 days in the same way; its settings and rules, the company and its users remain. When a subscription ends or an authorization is revoked, the affected Amazon connections are switched off before anything is deleted, so no new collection starts. Records of AI usage and cost are kept for accounting, and the security access log (the email and IP address used for sign-ins and administrative actions) is kept for 13 months; neither is part of account deletion. Backups age out on the managed database's retention schedule.

Retention periods, how to make a deletion request, and the rights you have over your data are set out in our Privacy Policy.

What we do not claim

Security pages tend to imply more than they deliver, so to be direct: SellerCopilot does not currently hold a SOC 2 or ISO 27001 certification, and does not run a third-party penetration testing programme. We are a small team building carefully rather than a large one with a compliance department, and we would rather tell you that than let a badge imply otherwise.

If your security team has a questionnaire, send it to us and we will answer it honestly, including the questions where the answer is "not yet".

Reporting a vulnerability

If you believe you have found a security issue, please write to [email protected] with enough detail to reproduce it. We will acknowledge your report and keep you updated while we investigate. Please give us a reasonable opportunity to fix the issue before disclosing it publicly.

Contact

Questions about anything on this page: [email protected]. See also our Privacy Policy, which covers what we collect and the rights you have over it.