Security & Vulnerability Disclosure Policy

Last updated: 2026-05-24

11978853 CANADA INC. ("Agentic Sellar", "we") takes the security of our platform and our sellers' data seriously. This page describes how we protect data and how to report a vulnerability.

How we protect seller data

Encryption at rest. All Amazon refresh tokens, API credentials, and LLM API keys are encrypted with AES-256-GCM before storage. Encryption keys are held only in our hosting provider's secret manager, never in source control.
Encryption in transit. All traffic uses TLS 1.2 or higher.
Tenant isolation. Every database query is scoped by organization at the ORM layer. Cross-tenant access is treated as a critical bug.
No buyer PII. We do not request or store Amazon buyer personally identifiable information. Our SP-API application does not hold the Restricted Data role.
Least-privilege agents. Every automated action is gated by per-category permission tiers that sellers control, validated against deterministic numerical guardrails, and recorded in an append-only audit log.
Credential hygiene. Logs are scrubbed of credentials and tokens. Dependency updates are monitored continuously.

Reporting a vulnerability

If you believe you have found a security vulnerability in Agentic Sellar, we want to hear from you.

Email: security@agenticsellar.com
What to include: a description of the issue, steps to reproduce, the affected URL or endpoint, and any proof-of-concept material. Encrypted reports are welcome — PGP key available on request.
Response time: we acknowledge reports within 1 business day and aim to provide a remediation timeline within 5 business days.

Safe harbor

We will not pursue legal action against researchers who:

Make a good-faith effort to avoid privacy violations, data destruction, and service disruption;
Only interact with accounts they own or have explicit permission to test;
Do not access, modify, or exfiltrate data belonging to other sellers;
Give us a reasonable opportunity to remediate before any public disclosure.

Out of scope

Denial-of-service or volumetric attacks
Social engineering of our staff or our sellers
Issues in third-party services we use (Amazon, our hosting provider, our payment processor) — report those to the vendor directly
Reports from automated scanners without a demonstrated impact

Questions

General security questions that are not vulnerability reports can go to security@agenticsellar.com or support@agenticsellar.com.