Security FAQ
The questions a security review asks first, answered here in this site's own words. Where an answer has a document or an address behind it, the link sits at the end of it.
A review that works from a questionnaire has one: Security Questionnaire. Selltics' standing answers to the questions procurement reviewers ask most often, published on the main website. It carries statements the September 2026 review disproved and whose withdrawal has not merged yet; where it and this page disagree, this page is current.
Are you SOC 2 or ISO 27001 certified?
No. Selltics holds no security certification or attestation of any kind, and none is in progress. No audit firm has been engaged and no certification body has assessed the platform. Selltics also inherits none, because the environment that holds customer data runs on self-managed infrastructure rather than in a hosting provider's certified region.
Has a third party tested the platform, and can I see your audit reports?
No third-party penetration test has ever been performed and none is scheduled, so every review described on this page was run in-house by the operator. The September 2026 review produced a written report and a numbered item set, but both are internal working documents that are neither published nor offered on request, and the three earlier reviews produced no report at all. The descriptions on this page are the full account a reader has. Vulnerability reports are accepted at support@selltics.net, with no committed response time and no reward programme.
Where does the platform run, and who hosts it?
The environment that stores customer accounts and advertising data runs on self-managed single-node infrastructure that Selltics operates itself, with no managed database, cache or message-broker service behind it. There is no hosting provider whose physical-security certifications a reviewer can rely on for that layer. The only customer data that rests with an infrastructure provider is the raw advertising stream: the queues that carry it and the archive behind them. Moving the environment to managed hosting is filed work.
Is customer data encrypted at rest?
No, and Selltics does not claim it is. No volume-level or database-level encryption is configured, and any protection from the underlying disks is not something Selltics can evidence. Application-level encryption for the credentials that read a customer's advertising data is built and deployed but not yet rolled out, so those credentials are not encrypted at rest today either. Selltics will not advertise encryption at rest until it is deployed, verifiable and stated with its scope.
Is data encrypted in transit?
Every published address is served over HTTPS, terminated by the external edge provider that fronts the platform, which therefore sees request and response content in readable form. Inside the platform the internal message bus is encrypted and certificate-verified in the environment that holds customer data, but connections to the datastores and to internal telemetry are not; they rely on staying inside one private cluster network that is not reachable from the internet. Selltics publishes no minimum TLS version, because that floor is a setting in the edge provider's console rather than in Selltics' own version-controlled configuration.
Do you support SSO or multi-factor authentication?
Yes for multi-factor (TOTP), required before connecting Amazon data; no SSO with your own identity provider. The second factor is a one-time code from an authenticator app. The API refuses to connect or re-authorise an Amazon account for a session that has not passed it, and an account that already has access to a connected Amazon account cannot continue until it has turned it on. For other accounts it is optional. There is no hardware-key or SMS factor. Sign-in is an email address and password, or a Google account. The settings screen where an account holder turns the second factor on is not yet open to customers. There is no directory provisioning and no IP allow-listing.
How is one customer's data kept separate from another's?
Each request acts in exactly one organization, decided server-side from the caller's memberships; a caller who names an organization they do not belong to is refused, and a request that cannot be resolved to an organization is refused rather than run unscoped. The services that hold customer data filter every query by that organization key, and a member can be narrowed further to named advertising profiles. The honest limit is that membership is proven once, at the edge: the services behind it re-scope every query by the key they are handed but do not independently re-prove the membership, because they hold no membership records. Organization administration is the exception and is re-validated inside the service that performs the write.
Can you tell me who at Selltics accessed my account?
No. The audit log records changes to organizations, membership, roles, invitations and account balance, and since October 2026 the sign-in and security events of an account; it is not an access log. It records no reads of customer data, and of the actions taken by Selltics staff it records only a support reset of two-factor authentication. Administrative access to the underlying infrastructure is not recorded in an attributable audit trail either, and administrative standing is not yet a per-person record with a grant date, an expiry and a periodic review. A data-backed administrator identity with its own audit trail is filed work.
Do your logs contain my data?
They can. The service that terminates customer API traffic strips credential-bearing values out of its own request log, but that is not an end-to-end property: the layer in front of it writes its own access record and is not covered by the rule. Some service logs can also contain message content and responses returned by upstream advertising APIs. Logs are operational records held under operator-only access, not a customer-content-free store, and no retention period is published because the log store does not yet sit on durable storage.
What happens to my data if I disconnect an account or leave, and can I get a copy?
Disconnecting withdraws the advertising account from the product at once, stops collection and stops the charges tied to it, but neither a disconnect nor deleting a profile deletes the advertising history already collected for the profiles you activated: Selltics keeps it indefinitely. That history is deleted on a written request sent by email to support@selltics.net, and Selltics completes the deletion within thirty days: a tracked job removes the requested profile's history from the time-series store and its part of the raw event archive. Once you activate one profile of an advertiser account, Selltics also stores the records of the account's profiles you did not activate in its archive, without showing them. That stored copy is deleted seven days after the account's last activated profile is deleted or disconnected, unless you activate a profile of the account again before then. If a written request removes the last activated profile of an advertiser account, the archived records of the account's profiles you never activated are deleted with it, while your other activated profiles of the account keep their data. Some archive records are not reached per seller: those that mix every seller expire after twenty-one days instead, and those archived before the archive was grouped per seller are being deleted in full. Copies in the scheduled database dumps leave as the dumps rotate. Any other deletion request is honoured by hand; that procedure is not documented, not measured, and produces no written confirmation of what was removed. A copy of an account's data is produced the same way, on request, because the product's only self-service export is a per-chart spreadsheet download.
Which third parties receive customer data?
The subprocessor register on this page lists every one, what it receives and where it processes. The ones that cannot be opted out of are the edge network that fronts all traffic, Amazon itself as the data source, the infrastructure provider that carries and archives the raw advertising stream, the payment provider that acts as merchant of record, and the code and build host, which holds no customer data but does hold the credentials that reach it. The AI assistant and its model provider, the messaging platform it is offered through, and the mailbox that carries support correspondence are reached only by a customer who chooses them.
What does the AI assistant send to the model provider, and can it train on my data?
Answering a question sends that seller's own message and the advertising data retrieved to answer it. Performance figures are summed by day first, but catalogue and campaign detail goes row by row, including product identifiers, titles, brands, categories, campaign names, budgets, bid strategies and targeting terms, with no redaction step on that path. Selltics cannot today show a negotiated term with any model provider that forbids training on submitted data or guarantees deletion after processing, and no data-residency or zero-retention setting is sent with a request. A customer who does not use the assistant sends nothing to any model provider.
How would I hear about an incident, and how fast?
A written incident process exists: assess, contain by revoking affected credentials and isolating affected workloads, notify affected customers and the advertising platform provider, remediate, then write a post-mortem. Its notification duties run from the moment Selltics detects, and detection is not bounded: nothing raises an automated alert, there is no on-call rotation and no round-the-clock coverage. Outages of the listed entry points appear on the public status page, which is checked once a minute from outside the product platform. Selltics commits to no detection time and no response-time service level.
Do you sign a DPA, and will you tell me before a subprocessor changes?
The Data Processing Addendum is published on the main website and is the authoritative text. Selltics cannot today produce a countersigned data-processing agreement with any of the parties in its register, and it operates no formal process for notifying customers in advance of a subprocessor change or for handling an objection to one. Each party is used under whatever standard public terms applied when the account was opened, and those terms have not been captured, dated or reviewed on a schedule. The register on this page is the change record: it is regenerated from the code, so a party that starts or stops receiving data appears or disappears here.
How do I reach a human, and is that where a security report goes?
Ordinary questions go to the public support page, whose form delivers what you write to the operator by email. There is no help desk product behind it, no ticket number and no response-time commitment, and nothing answers automatically, so the first reply you get is one a person wrote. A security report does not go there: the support page deliberately offers no security topic, because a disclosure filed into a queue that promises nothing is a disclosure the reporter believes they have made. Vulnerability reports go to support@selltics.net, which is the address this site publishes for them. An outage is published on the status page rather than answered from the support queue. The form and the report address both arrive in the one operator mailbox, which the subprocessor register lists.