Marketplace approvals, buyer data rules, incidents and security controls
Compliance
Two-step sign-in for every admin and staff account
Always on. Not recorded yet.
Least-privilege roles and narrowly scoped API keys
Reviewed quarterly. Not recorded yet.
Encryption in transit (TLS) and at rest for databases and backups
Always on. Not recorded yet.
Vulnerability scan
Monthly. Not recorded yet.
Penetration test
Yearly. Not recorded yet.
App runs as a non-root user behind a firewall
Checked at each deploy. Not recorded yet.
Buyer data removed 30 days after shipment; logs kept 12 months
Daily job. Not recorded yet.