Security

How Shelf looks after your account.

There is no password to lose and no seller login to hand over. This page says what is built to keep your account yours, what is not built yet, and how to tell us about a weakness.

Report a weakness What we keep about you

An account, at a glance

Sign-inA six-digit code to your email. No password.
SessionEnds on our server when you sign out.
PaymentTaken by Razorpay. The card never reaches us.
Your dataDownload it or delete it yourself.
The appsRead as a guest. No login of yours, ever.

What is built today. Each line is set out below.

Signing in

Most break-ins start with a password used twice. Shelf has none.

There is no password: You sign in with a six-digit code sent to your email address. Nothing can be reused from another site, guessed or leaked from ours.
A code is short-lived and counted: A code lasts 15 minutes, is used up when it signs you in, and five wrong tries end it. We store it only as a hash made with a key that only the account server holds, so a copy of the database signs nobody in.
Sign-in mail is rationed: An address can be sent only a few codes an hour, and so can a network. Someone else cannot flood your inbox, or lock you out by asking in your name.
A session is a random token: It is 32 random bytes, sent to your browser once and kept on our side only as a hash. No key exists that could mint one.
Signing out ends it on the server: Not only in your browser. A session also ends by itself after 30 days without use, and after 180 days in any case. An account keeps ten at most, and “Sign out of every browser” on the account page ends them all.

Your data

Yours to take back.

We hold what you choose to watch, never your sales, your orders or your ad account. The full list

One account cannot read another: The account server answers a request only with the data of the account whose session asked.
A plan is enforced on our servers: What a plan may read is decided where the data is served, never in the browser. A page cannot be edited into showing more.
A store is never an address: A dark store is shown as the 1 km square it stands in. Its exact position is not sent to a browser.
A secret you give us is sealed: The signing secret of your own webhook is stored encrypted, so a copy of the database cannot sign a message as us.
You can take it all back: Download everything we hold about you, or delete the account, from the account page. Deleting is immediate.

Payments and servers

Where the money and the machines are.

Payments

The card never reaches us: Razorpay takes the payment in its own window. We store its payment id, the amount and what it bought.
A payment opens a plan only on our own order: A plan opens when a payment matches an order our server made, for exactly that order’s amount. Nothing typed into a payment can grant a plan.
Nothing is charged without your yes: We hold no card. Autopay, if you turn it on, is a mandate Razorpay holds for us, and you stop it from Account at any time.
An invoice opens only for its owner: A tax invoice is written for every payment. Its page opens only for the account it was issued to, so its address can be mailed without the invoice being public.

Servers

One way in: The account server answers only our own front door, which holds a key no browser has. Finding its address opens nothing.
Encrypted on the way: Everything between your browser and us travels over HTTPS, and a browser that has visited once is told to refuse anything else.
Only named scripts run: Every page tells the browser which scripts it may run: our own files, the payment window’s, and the visit counters named on the privacy page, and nothing else. A script slipped into a page does not run, and no other site can put a page of ours inside a frame.
Errors say nothing: A failure answers with a sentence we wrote. No stack trace, no database message, no echo of what was sent.
Calls out are fenced: An alert posted to a webhook you gave us goes only to a public https address, checked before every call, with a time limit and no redirects. A link you paste anywhere else is stored as text and never opened.
A short security log: Sign-ins, sign-outs, plan changes and deletions are recorded for 400 days, without any secret.

The companies whose machines are involved, and what each sees: Sub-processors

Said plainly

What is not built yet.

You should hear this from us, before you find it out.

A second step at sign-in: Signing in is the mailed code and nothing more. Your mailbox is the key, so protect it with its own second step.
A list of your signed-in browsers: You can end every session at once from the account page. You cannot yet see them one by one.
An outside audit: We hold no certificate such as SOC 2 or ISO 27001, and no outside firm has tested the product yet. We answer a security questionnaire for a customer who needs one.
Single sign-on: There is no SAML or company directory sign-in.

Found a weakness?

Tell us, and we will thank you.

Write to security@seetheshelf.com with what you found and how to see it. A person reads it. The same address is in our security.txt.

What we do: We aim to acknowledge your report within two working days, tell you what we found, and tell you when it is fixed. If you want your name on the changelog entry, it goes there.
What we ask: Stop at the first sign of another person’s data and do not keep it. Do not slow the product for others, and do not test with someone else’s account. Give us a reasonable time to fix a weakness before you describe it in public.
What we promise: We will not take legal action against someone who looks in good faith and keeps to the lines above.
What we cannot offer yet: A paid bounty. We are a small company, and we say thank you by name instead.

For a security or legal review