Security

Sensitive credentials — including Shopify access tokens, StockX credentials, and Discord client secrets — are encrypted at rest using AES-256-GCM. We never log decrypted secret values.

All traffic between your browser, our services, and our sub-processors is encrypted in transit using HTTPS/TLS.

Sign-in is handled through Discord OAuth 2.0 — we never see your Discord password. Sessions are maintained with an HMAC-signed, HTTP-only session cookie, and OAuth flows are protected by a short-lived anti-CSRF state token.

The platform enforces role-based access control. Each user is granted only the permissions appropriate to their role (shop administrator, staff, or seller), and access checks are enforced on the server, not only in the browser.

We host data with established providers and pass only the data each needs to function:

• MongoDB Atlas — primary database.
• Railway — application and Redis hosting.
• Cloudflare R2 — file and object storage.

We collect only what the service needs. From a connected Shopify store we read only orders, products, and customers — no other Shopify data — and we do not request permission scopes beyond what those areas require.

If you believe you have found a security vulnerability, please report it to us at info.theseedtechnology@gmail.comwith enough detail to reproduce the issue. We ask that you give us a reasonable opportunity to address it before public disclosure, and that you avoid accessing or modifying other users' data. We will not pursue legal action against good-faith research conducted under these guidelines.

No system is perfectly secure. While we work to protect your data, we cannot guarantee absolute security. This page describes our measures and does not create warranties beyond those in our Terms of Service.