Data Security
The security controls in place for Sotrics today: authorization, encryption, access control and incident response.
1. Overview
This page lists the security controls in place for Sotrics today. It lists only controls that are actually implemented, and it is updated as we add more.
2. Amazon authorization
Sotrics never asks for or stores Amazon passwords. Amazon authorizations (refresh tokens and related credentials) are verified with Amazon before they are saved, are encrypted before storage, are used only on our servers, and are never sent back to the browser.
3. Encryption
- All traffic to sotrics.com, the app and Amazon's APIs uses HTTPS (TLS).
- The connection between the app and its database is encrypted, and the database's certificate is verified.
- Amazon tokens and secrets are encrypted at field level with AES-256-GCM before they are stored.
- The database runs on a managed PostgreSQL service with storage encryption and automatic daily backups provided by our hosting provider.
4. Access control
- Every request is checked on the server so that each user can reach only their own organization's data and the marketplaces they are allowed to see.
- Organizations can give team members roles that limit what they can see and do.
- Passwords are stored only as bcrypt hashes, new passwords must be at least 10 characters, sign-in attempts are rate-limited, and customers can turn on two-factor sign-in.
- Our internal administration area is separate from the customer app, requires multi-factor authentication, has short session time-outs, locks after repeated failed sign-ins, and records an audit log of administrator actions.
5. Hosting
The Sotrics application and database run on DigitalOcean (App Platform and managed PostgreSQL database), Bangalore data centre (BLR1), India. The marketing websites run on Hostinger.
6. Improvements in progress
- One-click Amazon authorization through Amazon's consent page.
- Amazon Ads API connection (pending Amazon's approval).
7. Incident response
We follow a written incident response plan. If a security incident involves Amazon information, we will notify Amazon within 24 hours of detecting it. We will notify affected customers without undue delay and as the law requires. Security contact: security@sotrics.com.
8. Report a vulnerability
Email security@sotrics.com with enough detail to reproduce the issue. Please do not access other people's data or disrupt the service.