Last updated: 2026-05-24
11978853 CANADA INC. ("Agentic Sellar", "we") takes the security of our platform and our sellers' data seriously. This page describes how we protect data and how to report a vulnerability.
How we protect seller data
- Encryption at rest. Amazon refresh tokens, API credentials, and optional LLM API keys are encrypted with AES-256-GCM before storage. Encryption keys are held only in our hosting provider's secret manager, never in source control.
- Encryption in transit. All traffic uses TLS 1.2 or higher.
- Tenant isolation. Tenant-owned records are scoped by organization, and authenticated routes verify organization membership or an approved agent-account binding before access. Cross-tenant access is treated as a critical bug.
- No buyer PII. We do not request or store Amazon buyer personally identifiable information. Our SP-API application does not hold the Restricted Data role.
- Least-privilege connections. Workspace owners choose the Amazon accounts and scopes available to each AI-client grant. MCP and REST writes require a write scope and explicit confirmation on every call, and accepted calls leave receipts. Optional automation features have separate permission controls and action logs.
- Credential hygiene. Logs are scrubbed of credentials and tokens. Dependency updates are monitored continuously.
Reporting a vulnerability
If you believe you have found a security vulnerability in Agentic Sellar, we want to hear from you.
- Email: security@agenticsellar.com
- What to include: a description of the issue, steps to reproduce, the affected URL or endpoint, and any proof-of-concept material. Encrypted reports are welcome , PGP key available on request.
- Response time: we acknowledge reports within 1 business day and aim to provide a remediation timeline within 5 business days.
Safe harbor
We will not pursue legal action against researchers who:
- Make a good-faith effort to avoid privacy violations, data destruction, and service disruption;
- Only interact with accounts they own or have explicit permission to test;
- Do not access, modify, or exfiltrate data belonging to other sellers;
- Give us a reasonable opportunity to remediate before any public disclosure.
Out of scope
- Denial-of-service or volumetric attacks
- Social engineering of our staff or our sellers
- Issues in third-party services we use (Amazon, our hosting provider, our payment processor) , report those to the vendor directly
- Reports from automated scanners without a demonstrated impact
Questions
General security questions that are not vulnerability reports can go to security@agenticsellar.com or support@agenticsellar.com.