Updates
What changed in the security posture, newest first. Every entry records something that has already happened: a control changed, an audit completed, a subprocessor started or stopped receiving data, or a document was published.
Nothing here is a plan: a change appears once it is true, dated the day it became true.
Category: Control
Whole advertiser accounts archived, never-activated profiles deleted after seven days
While an advertiser account has at least one profile activated in Selltics, the performance records of every profile of that account are now archived, including the profiles the customer did not activate; only activated profiles are loaded into the product and shown. That part of the archive is grouped per advertiser account and profile. When the account's last activated profile is deleted, Selltics stops keeping the account's records at its next ingest run, and the archived records of its never-activated profiles are deleted seven days later, unless a profile of the account is activated again before then. A written request for a profile that removes the account's last activated profile also deletes those records, and the account's other activated profiles keep their data. Activated profiles keep the existing rule: kept indefinitely and deleted on a written request within thirty days. The statements on the data categories held, the disconnect, the retention and deletion of advertising history, the deletion procedure and the archive's register entry were rewritten to match.
Category: Control
Deployment secrets moved to a managed parameter store
In the environment that holds customer data, the secrets of the services, data stores and operational tools are now read from a cloud provider's parameter store, encrypted under a key the provider manages, instead of being committed as encrypted objects generated from the build system's variable store. The cluster's reader can read only its own environment's values, every read is recorded in the provider's audit log, and one credential, the one that reaches the store, is still committed as ciphertext. Three cluster-access credentials, for the image registry, the deployment tool's repository access and the edge tunnel, are placed by the operator from local files rather than read from the store. The build pipelines have not moved yet, and the old copies in the build system are still to be removed. Amazon Web Services was already in the subprocessor register; its entry now names this use. The statements on deployment secrets, on encryption at rest and key management and on the build system were rewritten to match.
Category: Control
Public status, trust and support pages moved to Cloudflare Workers
The public status page, this page and the public support page now run on Cloudflare Workers instead of a cluster of Selltics' own, and each is deployed by its build pipeline when a change is merged rather than by an operator. They still depend on nothing in the product platform. The status checks run there every minute, and a support submission the mail provider will not take is held in the support page's storage on Cloudflare, still deleted within thirty days. Cloudflare was already in the subprocessor register as the edge provider; its entry now names this use. The statements on the separation of the public sites, their deployment, the availability checks, the data categories held, workload limits, container hardening, reconciliation from version control, build traceability and rollback were rewritten to match.
Category: Subprocessor
Google Gemini and xAI Grok removed as model providers
The AI assistant's code no longer supports Google Gemini or xAI Grok, so DeepSeek is the only model provider it can send prompts to, and their credentials are removed from the deployment configuration. Both entries are removed from the subprocessor register, and the statement that a change of model provider is a configuration change is withdrawn: using another provider now takes a deployment of new code.
Category: Control
Advertising history deleted on written request within 30 days
Amazon advertising history stays kept indefinitely and is now deleted on a seller's written request within thirty days. The request starts a tracked job that deletes the profile's rows from the time-series store, compressed history included, and its part of the raw event archive, which is now grouped per advertiser and marketplace. Archive records that mix every seller expire after twenty-one days, and disconnecting an account or deleting a profile still deletes nothing. The absence that denied any per-seller deletion and any limit on keeping the data is replaced by an in-place control, and the archive's register entry now describes the grouping and its expiry.
Category: Control
Two-factor authentication required before connecting Amazon data
Connecting an Amazon account to Selltics, or authorising one again, now requires a session that has passed the authenticator-app second factor, and the API refuses it otherwise. An account that already has access to a connected Amazon account must turn two-factor authentication on before it can continue. For other accounts it stays optional. New accounts also get no session until their email address is confirmed. The two-factor control moves from in progress to in place, and the register of what is not claimed now names only enterprise identity integration and the absence of a hardware-key or SMS factor.
Category: Subprocessor
Account and security email added, delivered by Cloudflare
The platform now sends account and security email, such as address confirmation, password-reset links and security notices, through Cloudflare Email Service, and Cloudflare forwards mail sent to Selltics' support address into the support mailbox. Both uses are added to Cloudflare's entry in the subprocessor register, and the statement that the platform sends no automated email is withdrawn. The delivery log keeps the recipient only masked and as a one-way hash, never the message, for thirty days.
Category: Control
Sign-in rebuilt: password policy, server-side sessions, a second factor
Passwords are now hashed with argon2id, with older bcrypt hashes replaced at the next sign-in, and a new password must be twelve to one hundred and twenty-eight characters and not known to have appeared in a breach. Ten consecutive failed attempts lock an account for fifteen minutes. Every new sign-in opens a server-side session that can be ended, and its long-lived token is replaced on every refresh. The bot challenge now fails closed. Optional two-factor authentication with an authenticator app is built, and the screen that turns it on is not yet open to customers. The statements on passwords, sessions, lockout, the bot challenge and multi-factor authentication were rewritten to match.
Category: Control
Shopper data statement corrected for the Selling Partner test connection
The statement on shopper data denied any connection to Amazon's Selling Partner API. There is one, in Amazon's test environment only, with a test authorisation held by Selltics and synthetic orders in reply; no seller can connect a real store. The statement now says so, together with which order fields are passed on and that buyer, address, tax and payment fields are dropped.
Category: Control
Disconnect statement narrowed for profiles with a Selling Partner marketplace
A profile can now draw on an Amazon Selling Partner marketplace as well as an Amazon Advertising account. Disconnecting the advertising account removes such a profile's advertising source only: the profile stays with its marketplace and keeps its charge. The disconnect statement said every profile of the account was removed and stopped being charged, and now says so only of the profiles with no marketplace.
Category: Subprocessor
Support page published, and the mailbox behind it added to the register
A public support page now takes a message and delivers it by mail to the address Selltics already publishes, so mail leaves the platform on one path and the mailbox that carries it, together with the operator replies written from it, is named in the subprocessor register. A delivered submission is stored nowhere on the way; one the mail provider will not take is held on the public-site cluster as a single file, with the address the sender gave and the text they wrote, until it is delivered or reaches thirty days. Three statements here were narrowed to say so rather than left standing.
Category: Document
Trust Center published
Every statement here was checked against the source code and the deployment configuration before it was written, and the claims that did not survive that check are published as absences. Where an older Selltics page disagrees with this one, this one is current.
Category: Control
Status and trust pages moved onto a separate plane
The public status page and this page now run on a cluster separate from the one that holds customer data, with their own connection to the edge, so they keep answering when the product platform does not. The deploy path for them is guarded against being applied to the product cluster.
Category: Control
Secret scanning added in one repository
Two independent secret scanners now run on every proposed change in one repository, with a rule set covering the credential formats this platform issues, and a hit fails the change. No other repository has an equivalent check.
Category: Audit
Platform-wide data protection review completed
Every product repository plus the chart, delivery and deployment configuration was read against an external marketplace data-protection standard. It produced sixty-eight sequenced remediation items across twelve repositories in five waves, and found twelve published or drafted statements the code does not support. None of the remediation has merged.
Category: Control
Account and billing audit trail wired end to end
The append-only record of membership, role, invitation, ownership and balance changes reaches its store, and the trigger for its nightly retention sweep is provisioned, so the one-year window is applied rather than only configured.
Category: Control
Billing review remediation merged
The August 2026 billing review's items were implemented across nine repositories and the control plane. A defect that could have returned another organization's balance was corrected first, and screens showing figures no backend produced were removed rather than filled with placeholder data.
Category: Control
Encryption key for connected-account credentials provisioned
The component that encrypts the credentials Selltics uses to read a customer's advertising data is deployed, and its key is delivered to the running service as an encrypted deployment secret. The rollout is not complete: those credentials are not encrypted at rest today.
Category: Control
Unauthenticated access to the internal message bus removed
In the environment that holds customer data the unauthenticated channel and its anonymous superuser were removed. Every service now connects with its own credential over an encrypted, certificate-verified channel, with its permissions granted individually.
Category: Control
Scheduled database dumps introduced
Every database is now dumped on a schedule, nightly for the transactional stores and weekly for the larger time-series store, onto storage that survives the workload being deleted or restarted. The dumps are compressed rather than encrypted and sit in the same failure domain as the databases.
Category: Control
Infrastructure metrics given durable history
Resource and health metrics for the host and for every workload are collected every thirty seconds and kept for fifteen days on storage that survives a restart, with standing dashboards over them. Nothing raises an alert from them.
Category: Control
Bot challenge switched on for sign-up and sign-in
Registration and sign-in put a bot challenge in front of the credential check in the environment that serves customers. At the time verification failed open, so it was published as a defence against automated abuse and not as an access control.
Category: Control
Rate limits wired at the API
Sign-in, registration and token refresh each carry their own request limit per source address, on top of a global limit over the whole API. The thresholds are configuration rather than code, so they can be tightened without a release.
Category: Subprocessor
DeepSeek became the model provider behind the AI assistant
The assistant sends its prompts to DeepSeek, the only model provider receiving customer data. Credentials for the two other supported providers are provisioned in the same environment, so a change of provider is a configuration change. Customers who do not use the assistant send nothing to any model provider.