Security controls

How FBA Hub protects Amazon Information.

Access

• Each account sees only its own data. Team members see only the areas the account owner allows.
• Two-step sign-in (authenticator app codes) is required for every account.
• Passwords:
  • at least 12 characters, with upper and lower case letters, a number and a special character
  • expire after 365 days
  • cannot be reused when changed
• Repeated wrong passwords or codes pause sign-in for 15 minutes.
• Devices (browser extension, phone) can be removed, which immediately blocks them.

Network

• The app runs on Vercel, which provides DDoS protection and a managed firewall, and serves every page over HTTPS only.
• The database runs on Neon, reachable only over TLS with credentials held as encrypted environment variables.
• Scheduled jobs prove themselves with a secret token; nothing else can trigger them.
• Pages send security headers that block framing, content sniffing and cross-site use.

Encryption

• All connections (browsers, the extension, the database, Amazon, Google and Keepa) use HTTPS or TLS.
• The database is encrypted at rest by Neon.
• Amazon refresh tokens, client secrets, the Keepa key and two-step secrets are encrypted at rest with AES-256-GCM.
• Credentials are never placed in source code, shared, or stored in public repositories.

Monitoring

A security log records:

• sign-ins, failed sign-ins and paused sign-ins
• new devices
• password changes
• changes to keys and store connections

Unusual events are flagged for review, and handled under the incident response plan.