Security Practices Overview

Contact: s-coreecliptorsupport@s-coreanalytics.com · Download as PDF

1. Executive summary

S-Core Ecliptor is an AI-first e-commerce intelligence platform for Amazon sellers, providing revenue, profitability, refund, and market-analysis insights built on the Amazon Selling Partner API (SP-API). Because the product connects directly to a seller’s Amazon account, our security program is built around strict credential isolation and scoping outbound API access as tightly as possible.

2. Scope and methodology

This overview covers the production API and its data stores. Controls described below were verified through:

• Manual line-by-line review of the authentication middleware, authorization checks on every API route, and tenant-isolation logic.
• Automated dependency vulnerability scanning (npm audit) across both the API and the web client.
• Direct review of the Amazon SP-API integration for outbound request handling, including the allowlist that constrains which hosts the server is permitted to call.
• Review of CORS configuration, rate-limiting configuration, and password-handling (hashing) code.
• Search across the codebase for string-concatenated or templated SQL to confirm query parameterization is used consistently.

3. Identity and access management

• Passwords are never stored in plain text; they are hashed with an industry-standard, computationally expensive hashing algorithm (bcrypt) before storage.
• Sign-in issues a signed JSON Web Token. Every request to your data is independently verified against that token server-side.
• Sign-in attempts are rate-limited to slow down credential-guessing attempts.
• Every database query that reads or writes your business data is scoped to your authenticated account.
• Email verification and password reset links are single-use and time-limited, and are stored as a hash rather than the raw value – a database read alone cannot be turned into a working link.
• Signing in with Google is supported as an alternative to a password; we verify the credential directly against Google and never see or store your Google password.

4. Your Amazon connection and data protection

• When you connect an Amazon Seller account, Ecliptor calls Amazon’s Selling Partner API (SP-API) through an allowlist that restricts outbound requests to Amazon’s own API hosts, protection against a class of attack (server-side request forgery) where a server is tricked into calling an internal or unintended address.
• Amazon refresh tokens and client secrets are held as server-side application secrets and are never sent to or exposed in your browser.
• All traffic to and from Ecliptor is encrypted in transit via TLS.

5. Application and infrastructure security

• Database queries are parameterized throughout the codebase, the standard defense against SQL injection; we reviewed every query in the application for this specifically.
• Cross-origin requests are restricted to an explicit allowlist of approved origins rather than a permissive wildcard.
• API requests are rate-limited to reduce the impact of abuse or credential-stuffing attempts.
• Application dependencies are scanned for known vulnerabilities.
• The running application reads its database credentials and Amazon API keys from the hosting provider’s environment configuration at runtime, not from a file bundled into the application or sent to your browser.

6. Third-party and sub-processor management

Ecliptor currently relies on the following sub-processors:

• Google Cloud Platform: application hosting and database (United States).
• Amazon Selling Partner API: used exclusively to retrieve the connected Customer’s own Amazon seller data on their behalf (United States).

7. What we are still building

We would rather tell you what is incomplete than imply otherwise. Before we consider Ecliptor ready to onboard live customer accounts, we are actively working on:

• Adding a Content-Security-Policy header to the application’s HTTP responses, currently in progress as part of the broader hardening pass ahead of general availability.
• Removing all remaining development-only configuration paths from anything that could run in a live environment.

Two items previously listed here are complete as of this version: the application dashboard now has a fully self-service sign-in and account creation flow (email/password and Google), and the infrastructure migration to Google Cloud referenced in Section 6 is finished.

8. Data retention and customer rights

• Because Ecliptor is not yet onboarding live customer accounts, no customer Amazon Seller data is currently retained in production.
• Once general availability begins, this section will be updated with concrete data retention periods and self-service deletion controls, consistent with the practices already shipped across our other products.

9. Independent assurance and certification status

• S-Core Ecliptor is not currently SOC 2 certified.
• S-Core Ecliptor has not completed an independent third-party penetration test as of the effective date of this page.
• Both are goals we are working toward ahead of general availability. This page will be updated, and the version above incremented, the moment either status changes to reflect a completed, independently verified engagement.

10. Report a security issue

If you believe you have found a security vulnerability in Ecliptor, please email us directly rather than filing a public report. We take every report seriously and will respond promptly.