Security

SellerCopilot connects to your Amazon seller account and analyses your business data. This page describes, in plain terms, how that data is protected, what we deliberately choose not to store, and what happens when you leave. It is written to be read by your security or compliance team as much as by you.

We describe only controls that are in place today. Where something is a limitation, we say so rather than leaving it out.

The buyer data we do not store

The most reliable way to protect personal data is not to hold it. SellerCopilot stores no buyer email addresses, no buyer names, and no street addresses.

Our repeat-purchase and customer-value analytics need to recognise that two orders came from the same customer. They do not need to know who that customer is. So instead of storing an identity, we derive a one-way cryptographic hash and store only that. The hash is stable enough to link a customer's orders together and irreversible, so it cannot be turned back into the details it came from.

Alongside it we retain only coarse location — city, state or province, postal code and country — which we use for aggregate geographic analysis. On its own that does not identify an individual.

Encryption

• In transit. Every connection to the application and to the marketing site is served over HTTPS/TLS. Plain HTTP requests are redirected to HTTPS.
• Amazon credentials at rest. The refresh tokens and client secrets that authorise access to your Amazon accounts are encrypted with AES-256-GCM before they are written to the database. The encryption key is held as a server environment secret, separate from the database itself, so a copy of the database alone does not yield usable Amazon credentials.
• Database at rest. Your data is held in a managed PostgreSQL service that encrypts data at rest, including backups, and supports point-in-time recovery.
• Passwords. Account passwords are never stored. We keep only a bcrypt hash with a per-password salt.

Where your data lives

Application servers and the production database are hosted in the United States. We do not replicate your data to other regions and we do not sell, rent, or share it with third parties for their own purposes.

Account isolation

Every record belonging to your business carries your company identifier, and every query the application makes is scoped to the company of the signed-in user. You see your data and nothing else.

To be precise about how that is enforced: isolation is applied in the application layer, on every query, rather than by database-level row security. This is a deliberate, documented convention that all new code must follow, and it is the same mechanism that protects each of your own Amazon marketplaces from being mixed with the others.

Access and authentication

• Sessions are stored server-side. Session cookies are HTTP-only, restricted to HTTPS, and expire after seven days.
• Accounts are created by invitation. New users set their own password through a single-use link that expires after one hour.
• Each user can be restricted to a subset of pages, so you can give a team member the inventory view without giving them financial data.
• Access to production systems is limited to the people who operate the service.

How AI features handle your data

SellerCopilot uses Anthropic's Claude models to generate written reports and to answer questions in the assistant. Three things are worth knowing:

• Your data is not used to train models. We send data to Anthropic's API, which excludes API inputs and outputs from model training.
• Product names are anonymised before they leave. Audit reports replace your product identifiers with neutral placeholders before the request is sent, and restore them in the response. The model works on the numbers, not on your catalogue.
• The assistant can only read. It answers from a fixed set of read-only queries that are locked to your company and account on the server. It cannot write, delete, or run free-form database commands, and it cannot reach another customer's data.

Amazon data handling

We request only the data categories needed for the analytics described on this site, and we handle data obtained through Amazon's APIs in accordance with Amazon's Acceptable Use Policy and Data Protection Policy. You can revoke SellerCopilot's access from within Amazon Seller Central at any time; revocation stops all further data collection immediately.

Deletion

When an account is closed, the company record and all of its associated data — sales, advertising, inventory, orders, financial transactions, reports and recommendations — are permanently removed from the production database. Encrypted backups age out on the managed database's retention schedule.

Retention periods, how to make a deletion request, and the rights you have over your data are set out in our Privacy Policy.

What we do not claim

Security pages tend to imply more than they deliver, so to be direct: SellerCopilot does not currently hold a SOC 2 or ISO 27001 certification, and does not run a third-party penetration testing programme. We are a small team building carefully rather than a large one with a compliance department, and we would rather tell you that than let a badge imply otherwise.

If your security team has a questionnaire, send it to us and we will answer it honestly, including the questions where the answer is "not yet".

Reporting a vulnerability

If you believe you have found a security issue, please write to [email protected] with enough detail to reproduce it. We will acknowledge your report and keep you updated while we investigate. Please give us a reasonable opportunity to fix the issue before disclosing it publicly.

Contact

Questions about anything on this page: [email protected]. See also our Privacy Policy, which covers what we collect and the rights you have over it.