Security Questionnaire
Effective date:
A pre-filled vendor security questionnaire, answered the way we would answer it for any customer's procurement review: plainly, including what we do not have. Fuller text lives in the Information Security Policy, the Data Processing Addendum, and the Privacy Policy. Questions not covered here: support@selltics.net.
1. Company and governance
- Who operates the service?
- Individual Entrepreneur Myroshnichenko Dmytro, registered at 17 Tekstylna St., Bldg. 41, Kherson, Kherson District, Kherson Region, Ukraine. It is a single-operator organisation: one operator owns security end to end.
- Do you have a documented security policy?
- Yes, and it is public: the Information Security Policy. It is reviewed at least annually and after incidents or significant architecture changes.
- Do you hold SOC 2, ISO 27001, or similar certifications?
- No. We hold no certifications and do not claim any. Our approach is documentation-first: public policy, public questionnaire, and written answers on request.
- Is there a dedicated security team?
- No separate team — the operator is directly responsible for security, with no handoffs. Contact: support@selltics.net.
2. Hosting and infrastructure
- Where is the service hosted?
- In a private Kubernetes cluster in a single region. All public traffic enters through a single Cloudflare Tunnel; no database or internal service has a public endpoint.
- Are there any public admin interfaces?
- No. There are no unauthenticated admin surfaces. Operator access goes over a private Tailscale network: cluster access is granted per tailnet identity through the Tailscale Kubernetes operator, and internal admin interfaces are reachable only from that network.
- Is the environment segmented?
- At the data layer, yes: ten isolated per-service Postgres/TimescaleDB databases, each with its own credentials. We do not currently claim Kubernetes NetworkPolicies.
3. Encryption and key management
- Is data encrypted in transit?
- Yes. All public traffic is encrypted with TLS 1.2+, terminated by Cloudflare at the single tunnel ingress.
- Is data encrypted at rest?
- Not currently claimed. We do not advertise encryption at rest until it is deployed and verified.
- How are credentials stored?
- Passwords as argon2id hashes; a password stored earlier as a bcrypt hash is replaced by an argon2id hash at its next successful sign-in. Refresh tokens and trusted-device tokens are stored only hashed, and recovery codes only as keyed hashes (HMAC-SHA256); none of these can be recovered from what is stored. Two-factor authenticator secrets are encrypted by the application with AES-256-GCM, because the application has to read them to check a code.
- How are secrets managed?
- As encrypted SealedSecrets committed to git and decrypted only inside the cluster. No plaintext secrets in code or CI.
4. Access control and authentication
- What sign-in methods are supported?
- Email/password and Google OAuth. Authentication endpoints are protected by a Cloudflare Turnstile challenge. New accounts must confirm their email address before their first sign-in.
- Is MFA supported? Is it enforced?
- Supported: two-factor authentication with an authenticator app (TOTP) only, with no SMS and no hardware keys; a code already accepted is refused if presented again. Enforced for accounts with a connected Amazon account: two-factor authentication is required before an Amazon account can be connected or reauthorized, checked server-side by the API, and an account that already has a connected Amazon account must enroll before it can continue. Optional for all other accounts. A lost device is covered by recovery codes first, then by a manual identity check through support with a 24-hour objection window.
- What is the password policy?
- 12 to 128 characters, no composition rules, and a check against known breached passwords through the Pwned Passwords range API (only a 5-character SHA-1 prefix leaves the platform).
- What are the session token lifetimes?
- JWT access tokens live 15 minutes; refresh tokens live 7 days, rotate on every use and are stored hashed. A session ends after 7 days without use and at the latest 30 days after sign-in, and can be revoked.
- Are authentication endpoints rate-limited?
- Yes, per IP on the real client IP via Cloudflare: global API 60 requests/minute, login 5/minute, registration 3/minute, token refresh 30 per 5 minutes.
- Is there brute-force protection?
- Yes, Redis-backed: at most 20 failed attempts per IP and 5 per account per 15 minutes; exceeding either triggers a 15-minute lockout. In addition, 10 consecutive failed password attempts lock the account itself for 15 minutes, and 10 consecutive wrong two-factor codes pause two-factor sign-in for 15 minutes.
5. Secure development and change management
- How is source code protected?
- Private git repositories and a private container registry (GitLab). Dependencies are pinned through lockfiles.
- How do changes reach production?
- GitOps: CI builds images tagged with the immutable commit SHA, ArgoCD applies the declared state, and promotion is human-gated. No ad-hoc production changes.
- Do you run third-party penetration tests?
- No third-party penetration test has been performed to date. We say so plainly rather than imply otherwise.
6. Incident response
- Is there a documented incident process?
- Yes — six steps: detect & triage, contain, notify, eradicate & recover, written post-mortem within 5 business days, with evidence preserved throughout. See the Information Security Policy.
- How quickly are customers notified of a breach?
- Personal-data breaches are notified to affected customers and authorities within 72 hours where required by law.
- Do you have 24/7 monitoring and alerting?
- Logging is centralized with 30-day retention, but there is no formal 24/7 alerting rotation — it is a single-operator service, and we do not claim otherwise.
7. Business continuity and backups
- How is data backed up?
- Nightly (02:00) logical pg_dump of the ten service databases — isolated databases, each with its own credentials — gzipped, on a 14-day local rotation. The time-series advertising-metrics store is backed up weekly on a 28-day rotation, and its raw metric events are additionally archived to offsite object storage continuously; the archive is partitioned per advertiser and marketplace, and its performance archive per advertiser account and profile, and the records of activated profiles are kept indefinitely. The restore procedure has been exercised.
- Are backups stored offsite?
- The database dumps are not — they are single-region. The raw advertising-metrics event archive is continuously written to offsite object storage. Full offsite dump copies are listed among the claims we do not make on the trust center.
- Is the service highly available or multi-region?
- No. The platform runs in a single region without formal HA or disaster-recovery guarantees.
8. Subprocessors
- Who are your subprocessors?
- Cloudflare, GitLab, AWS, the Amazon Ads API, Paddle, DeepSeek, Google, and Telegram. The authoritative table with purposes lives in the Data Processing Addendum.
- Which AI providers can process prompts?
- DeepSeek only: it is the single LLM provider and the only one that may process prompts. Prompts contain only minimum aggregated, non-PII metrics, and DeepSeek is used under terms that prohibit training on submitted data.
- How are subprocessor changes communicated?
- By publication. The DPA's subprocessor list is updated and its effective date moved forward before a subprocessor is added or replaced, so the change is published before it takes effect; there is no in-product notification and no mailing list. The right to object, and to terminate on an unresolved objection, is unchanged.
9. Data retention and deletion
- What happens to data when a customer leaves?
- On account disconnect, termination, or written request, customer data other than Amazon Ads history is deleted from live databases within 30 days. Backup generations are removed by the rotation that follows a successful dump: while the dumps succeed, nightly dumps at most 16 days and weekly dumps at most 35 days after they were taken.
- How long is Amazon Ads history kept?
- Indefinitely, for every activated profile. The advertising metrics and catalog history in the time-series store and the raw stream archive, partitioned per advertiser and marketplace, and its performance archive, partitioned per advertiser account and profile, are kept so that a customer can compare a period with the same period in earlier years. A disconnect, a profile deletion or termination does not delete them. On a written request to support@selltics.net they are deleted from the live databases and from the customer's archive partitions within 30 days. Archive records that cannot be attributed to an advertiser and marketplace, and failed deliveries, are kept at most 21 days.
- What happens to profiles of an advertiser account that were never activated?
- While at least one profile of an advertiser account is activated, the performance records of every profile of that account are archived; the never-activated profiles are stored only, not shown and not used by any feature. Deleting a profile stops collection for it, and deleting the last activated profile of the account stops collection for the account. The archived records of never-activated profiles are deleted 7 days after the last activated profile of the advertiser account is deleted, unless a profile of that account is activated again within those 7 days. A written request for a profile that removes the last activated profile of its advertiser account also deletes the archived records of the account's never-activated profiles; the history of the account's other activated profiles is kept.
- Is Amazon Selling Partner data kept the same way?
- No. Order data is read from Amazon through the Selling Partner API on each request and is not kept as a history, and a Selling Partner disconnect deletes the authorization token immediately.
- How long are AI records kept?
- Prompts and tool results are retained 30 days in the AI audit store, then pruned.
- How long are payment records kept?
- Payment records are kept as long as accounting and tax law requires; the invoice for each top-up is issued by Paddle, the merchant of record. The raw webhook body Paddle sends to confirm a payment is kept 90 days and then erased, leaving only the record that the event was received.
- How long are logs kept?
- 30 days, centralized; logs exclude secrets, tokens, and customer data payloads.
- How long are authentication records kept?
- Unconfirmed sign-ups are deleted after 7 days; session and trusted-device records 30 days after they expire or are revoked; the email delivery log after 30 days; security audit events after 365 days. Two-factor data is deleted when two-factor authentication is turned off or reset by support. Consent records are kept 3 years after account deletion and removed on request after that.
10. Privacy and compliance
- Do you process buyer PII?
- No. Advertising and order data is consumed in non-PII form — no buyer names, addresses, or other personal details.
- Is customer data used to train AI models?
- No. LLM providers are used under terms that prohibit training on submitted data.
- Do you offer a DPA?
- Yes — the public Data Processing Addendum, including Standard Contractual Clauses for third-country transfers.
- How are privacy requests handled?
- Per the Privacy Policy, via support@selltics.net.