Security & data handling

OpSyncPro touches sensitive data — OAuth tokens, customer PII, payment metadata. Here’s how we protect it.

Principles

Six commitments that drive every architectural decision in OpSyncPro.

Encryption at rest

Every OAuth token, API key, and buyer-PII column is encrypted with AES-256-GCM before it's written to Postgres. Different keys for different concerns — your social tokens and your buyer data are isolated even from a single key compromise.

Row-level security

Every multi-tenant table enforces `auth.uid() = user_id` via Supabase RLS. Service-role bypass is locked to specific service accounts, never exposed to the frontend. We test the boundary on every PR.

Token rotation

OAuth refresh tokens rotate on every refresh (TikTok mandates it; we follow the same pattern for the others). Long-lived Meta tokens auto-refresh ~10 days before expiry. Stale tokens flip the connection to "needs reauth" so the UI prompts you, not so we silently fail in the background.

Buyer PII retention

Amazon order PII (ship-to, payment last-4, raw email subjects) is purged automatically 30 days after the order date. We retain only what's required for analytics — order number, retailer, total, classification.

Compliance touchpoints

eBay Marketplace Account Deletion notifications acknowledged and processed within minutes. Meta Deauthorize + Data Deletion callbacks wired. Google sensitive-scope use limited to the documented user-facing flows. Amazon SP-API access scoped to the minimum roles needed.

Incident response

Internal SLA: any reported security issue triggers a runbook within 1 hour. Better Stack alerts pipe to Discord with on-call routing. Annual key-rotation audit with a documented procedure.

Compliance status

We document our compliance posture publicly so you can audit it.

  • ● GDPR Article 33 — 72hr breach notification — documented + practiced
  • ● Amazon Data Protection Plan — submitted
  • ● Meta App Review compliance — in progress
  • ● Google OAuth verification — in progress
  • ● TikTok Content Posting API audit — in progress

Reporting a vulnerability

Security disclosures are taken seriously. If you’ve found something concerning, please reach out before public disclosure so we can fix it.

security@opsyncpro.io

We aim to acknowledge within 24 hours and remediate critical issues within 7 days.

Read the full Privacy Policy

Sub-processor list, GDPR + CCPA disclosures, retention windows, and the Limited Use Disclosure for Google data.

Privacy Policy