Security

How we protect your data

SellerHelp holds order, inventory, pricing and settlement data from your marketplace accounts. This page describes the controls that protect it. Report a suspected security issue to security@sellerhelp.pl.

Hosting and encryption

Where your data lives

All customer data is stored and processed on infrastructure located in the European Union: servers operated by Hetzner Online GmbH in Nuremberg, Germany.

Data in transit is protected with TLS 1.2 or higher; plain HTTP requests are redirected to HTTPS. The database accepts connections only from the application server itself and has no public endpoint.

Marketplace authorisation credentials — including Login with Amazon client credentials and per-seller refresh tokens — are encrypted by the application before they are stored and are never displayed in full in the user interface.

Personal data of buyers (name, street address, telephone, e-mail, tax number, raw order payloads and shipping labels) is encrypted at the application level (AES-256) before it is written to the database, and database backups containing it are additionally encrypted (GPG, asymmetric key, the private key held offline and never stored on the server) before they leave the server.

Encryption keys for application-level data protection are managed through the ASP.NET Core Data Protection key ring, stored with file permissions restricting access to the application’s own service account only. Keys rotate automatically on a fixed lifetime and historical keys are retained so that previously encrypted data remains readable after rotation.

Each customer’s data is scoped to that customer’s account; administrative functions are restricted to authorised personnel by role.

Access

Who can reach the system

• Multi-factor authentication (time-based one-time passwords) is mandatory for all SellerHelp staff and administrator accounts and available to every customer account.
• Passwords must be at least 12 characters long and include an upper-case letter, a lower-case letter, a digit and a special character; a password may not contain the account’s own e-mail address or company name.
• Repeated failed sign-in attempts are rate-limited per address and per account.
• Administrative functions are restricted by role.
• Server access is key-based only; password authentication over SSH is disabled.

Malware protection and vulnerability management

Keeping the platform clean and patched

• Antivirus scanning (ClamAV) runs daily against the application code and any newly written files, with automatically updated signature definitions; a detection triggers an immediate alert to our team.
• Security updates for the operating system are installed automatically.
• Third-party software dependencies are scanned for known vulnerabilities (CVEs) on every deployment, and any finding is reviewed before release.
• Our first independent, third-party penetration test is scheduled for Q1 2027, with an annual cadence thereafter.

Buyer data

Personal data of your customers

Personally identifiable information about buyers obtained from Amazon (name, address, telephone, e-mail) is used only to fulfil your orders, print shipping labels and issue invoices. It is deleted automatically no later than 30 days after the order is delivered. We do not sell it, use it for advertising or marketing, or combine it with other data to identify or profile individuals.

Where tax or invoicing law requires a longer retention period, the data is held in a restricted-access archive for the statutory period and used for no other purpose.

Application logs do not contain buyer personal data (name, address, phone, e-mail) or raw marketplace API payloads; log retention is capped and old log entries are purged automatically.

Incidents

What happens if something goes wrong

If we confirm an incident affecting data obtained from a marketplace platform, we notify that platform within 24 hours of detection through the channel it designates. Affected customers are notified without undue delay, and the Polish supervisory authority within 72 hours where the GDPR requires it.

To report a suspected vulnerability or incident, write to security@sellerhelp.pl. We will not pursue legal action against researchers who report findings in good faith, do not access or modify data beyond what is needed to demonstrate the issue, and give us reasonable time to remediate before disclosure.

Retention

How long we keep data

You can request deletion of your data at any time by writing to biuro@sellerhelp.pl; we confirm in writing within 30 days. Full detail is in our privacy policy and data processing agreement.

Subprocessors

Third parties with access to data

We do not share customer or marketplace data with advertising networks or data brokers. We use the following subprocessors, each bound by a written agreement:

We notify customers before adding a subprocessor with access to their data.

Contact

Reaching the right person