GBNOX Radar holds two things worth protecting: the credentials that reach your marketplace accounts, and the commercial data of your business and your clients. This page says what we do about both. It describes measures in place today — not aspirations.
Marketplace credentials
- Amazon and Walmart credentials are encrypted at rest with AES-256-GCM, an authenticated cipher, so tampering is detectable and not merely unlikely.
- The encryption key lives only in the server environment, never in the database, never in source control and never in a backup of either. Someone holding a copy of the database cannot read the credentials in it.
- Credentials are decrypted in memory only for the duration of an API call you asked for, and are never returned to the browser or written to a log.
- Disconnecting a marketplace from Settings deletes the stored credentials immediately.
Accounts and access
- Passwords are hashed with bcrypt and are never stored, logged or recoverable in readable form. Nobody at GBNOX can tell you your password, because nobody can read it.
- Sessions use signed JSON Web Tokens with a limited lifetime. Signing out invalidates the session in the browser.
- Password reset links are single-use, expire after one hour, and are stored only as a SHA-256 hash — a stolen database row cannot be replayed as a reset link.
- Accounts provisioned automatically after purchase are issued a random password and must change it before reaching any data.
- Rate limiting applies to sign-in, registration, password reset and the email-availability check, so credentials cannot be guessed at speed.
- Roles separate an agency owner, team members and client users. Data is scoped to a workspace, and every request is authorised server-side — hiding a control in the interface is never what enforces access.
In transit and at rest
- All traffic is served over HTTPS, with HTTP redirected and HSTS set.
- The database connection is encrypted and reached over TLS on the provider’s network.
- Responses carry
X-Content-Type-Options,Referrer-Policy,X-Frame-OptionsandStrict-Transport-Security. - The dashboard and the API send
X-Robots-Tag: noindexso customer surfaces never enter a search index.
Payments
Card details are entered on Stripe’s own payment page and travel from your browser directly to Stripe. No card number ever reaches our servers, our database or our logs. We store only what Stripe returns: a customer reference, the plan, and the billing address you gave us. Stripe is a PCI DSS Level 1 service provider.
Hosting and infrastructure
- Application data is held in a managed PostgreSQL database in the United States (AWS, us-east-2), with encryption at rest and provider-managed backups.
- Secrets are supplied to the application through the server environment, outside the web root, and are readable only by the application’s own account.
- Administrative access to servers and the database is limited to named individuals and protected by multi-factor authentication.
Backups and recovery
The database provider takes continuous backups with point-in-time restore. We test the restore path when the schema changes materially. Backups inherit the same encryption and access controls as the live database.
Change control
Application changes are version-controlled and reviewed before release. Database schema changes run as versioned migrations, so the state of a database can be established from its migration history rather than by inspection.
Incident response
If we detect a security incident we contain it first, then establish what data was affected. Where a breach affects personal data and is likely to be a risk to you, we notify affected customers and the relevant regulator without undue delay, and within the deadlines the law sets. Notifications say what happened, what data was involved, what we have done, and what you should do.
Reporting a vulnerability
If you believe you have found a security problem, tell us through the contact form with “Security” in the message and enough detail to reproduce it. We aim to acknowledge within two business days.
We will not pursue legal action over good-faith research that stays within these bounds: work only against your own account, do not access or modify anyone else’s data, do not degrade the service, do not run automated scanning that generates significant load, and give us a reasonable chance to fix the issue before publishing.
What we do not claim
We are a small company in early access. We do not currently hold SOC 2, ISO 27001 or any other third-party certification, and we would rather say so than imply otherwise. If a certification matters for your procurement, ask us and we will tell you honestly where we are.
Questions about this document
Write to us through the contact form and say which document you are asking about. A person reads every message. Our postal address is 5005 W Laurel St, Tampa, FL 33607, United States.