Security

01Official Amazon access only

We connect through the Amazon Selling Partner API with the seller's own authorization, and never scrape Seller Central or automate a browser. Xolt identifies itself to Amazon on every request.

We never request restricted roles that expose buyer personal information. Columns with names, addresses, emails or phone numbers are dropped when a report is read, and order IDs are stored only as keyed hashes.

Sync stops the moment you disconnect, every connection can be paused, and we can stop all Amazon traffic at once with a global switch.

02Encryption

All traffic uses HTTPS with HSTS. Amazon and Google authorizations are encrypted with keys held in AWS KMS and bound to the organization and connection they belong to, so a token cannot be decrypted for anyone else. They are never sent to your browser or written to logs.

The database and file storage are encrypted at rest.

03Isolation between customers

Every table that holds customer data carries the organization it belongs to, and the database itself enforces that one organization can never read another's rows (row-level security). Automated tests check this on every change.

04Accounts and access

Every member of every organization uses two-step verification with an authenticator app before they see any seller data. Connecting an Amazon account and deleting an organization ask for a fresh code.

Roles (owner, admin, member, viewer) limit who can connect accounts, invite people and change settings. Agencies can limit members to specific workspaces.

Passwords need at least 12 characters, including a symbol, and expire after 365 days. Sign-in attempts are limited per network and per account, and sessions expire after 7 days of inactivity.

05AI with a narrow boundary

The monthly action plan is written from aggregated findings only: product identifiers, titles and the numbers behind each finding. Raw reports, order data and buyer data never go to the AI provider, every number in its output is checked against the input, and your data is not used to train models.

06Hosting

The application runs on Vercel in Frankfurt, the database on Neon in Frankfurt, and file storage and encryption keys on AWS in Frankfurt (eu-central-1). The full list of companies that process data for us is on the Sub-processors page.

07Audit trail and monitoring

Sensitive actions such as connecting or disconnecting an account, invitations, role changes, removals, exports and deletions are recorded in an audit log. Errors are monitored with personal data and secrets removed.

08Secure development

Every change is reviewed, tested and scanned before release: dependency audits, secret scanning and static analysis run on every pull request, and changes to authentication, encryption or data access get a dedicated security review.

09Your control over your data

Disconnecting an Amazon account stops sync at once and wipes its authorization. Its data is deleted 30 days later, or immediately if you choose. Owners can export all of an organization's data and delete the organization, and every user can delete their account.

10Incidents and reporting a vulnerability

If we become aware of a security incident affecting your data, we will notify you without undue delay, and Amazon and the relevant authorities where the law or Amazon's policies require it.

Found a vulnerability? Write to privacy@xolt.io with the details and how to reproduce it. We will reply within 3 business days, keep you updated, and not take legal action against good-faith research that avoids harm to our customers and their data.