SECURITY

Practical safeguards around connected marketplace work.

Groviix is designed to keep credentials on the server, encrypt Amazon OAuth tokens, scope application data to the authorized customer and connection, and exclude production customer PII from development test data.

Report a security issue Privacy Policy

Security boundariesCurrent controls

HTTPS transportTLS for production website and application

Encrypted

Server-side credentialsTokens not exposed to the browser

Protected

Account-scoped recordsCustomer and connection context retained

Isolated

CURRENT TECHNICAL SAFEGUARDS

Controls implemented in the product architecture.

This public overview describes safeguards that currently exist. It does not claim a certification, audit result or control that has not been implemented and verified.

TLS

Encryption in transit

Production website and application traffic is served over HTTPS. Third-party API connections use encrypted transport.

256

Amazon token encryption

Amazon OAuth tokens are stored using AES-256-GCM authenticated encryption with unique initialization vectors and authentication tags.

RLS

Data access boundaries

Application authorization checks, connection identifiers and database row-level policies are used to limit records to the relevant user or account scope.

Private file storage

Operational files intended to remain private use access-controlled storage and time-limited signed access where the feature requires a download.

Administrative controls

Administrative and team-management functions are separated from ordinary product workflows and require authenticated, authorized access.

Test-data boundary

Development and test workflows use synthetic or deliberately prepared data instead of copying production customer PII into test fixtures.

RESTRICTED DATA

Direct Fulfilment operations minimize retained customer fields.

When an approved restricted API returns customer information as part of an authorized Direct Fulfilment request, Groviix is designed to filter customer names, addresses, contact details and buyer messages from stored operational records and from the product interface.

The operational record is limited to order or PO reference, SKU/ASIN, quantity, warehouse, status and timestamps needed to run the customer’s fulfilment workflow.

Restricted customer PII is not sent to generative AI providers.
Restricted customer PII is not used for advertising, profiling or external benchmarking.
Restricted customer PII is not used as development or test data.
Access is limited to approved application roles and an authorized customer account.

Direct Fulfilment capability remains subject to Amazon’s restricted-role approval and the connected Vendor account’s eligibility.

Operational logging

Application and worker activity produces operational logs used to investigate errors and workflow events. Sensitive values should not be deliberately placed in log messages.

Backup responsibility

Application releases and hosted data services are managed with recovery procedures appropriate to the service component.

Incident contact

Potential security or privacy incidents can be reported to amazon@allinwebsolutions.com for triage and response.

REPORTING

Tell us quickly if something looks wrong.

Include the affected URL, approximate time, steps to reproduce and a safe description of the issue. Do not email passwords, OAuth tokens, API secrets, customer PII or destructive exploit details.

Email the security contact

Security is a continuing process. This page is an overview and is not a warranty that the service is free from every vulnerability. Customers should also secure their Amazon users, email accounts, devices and internal access processes.