Security and data protection

Sellers trust us with their store connections, their carrier accounts and their customers' shipping addresses. This page explains how we protect that data.

We only use buyer data to ship the order

Buyer names, shipping addresses and phone numbers are used for one purpose: to create shipping labels, packing slips and shipment confirmations for the seller who received the order. We do not use buyer data for marketing, we do not sell it, and we do not combine data across sellers.

Sharing with carriers is limited to what a label needs

When a seller buys a label, Nexus Fulfill sends the carrier the seller selected (for example UPS, USPS, FedEx or DHL) only the fields that carrier requires to create and deliver that one shipment: the recipient's name, delivery address and, where the carrier requires it, a phone number, along with the package weight and size. The data goes directly to the carrier's API over an encrypted HTTPS connection, using the seller's own carrier account. Nothing else about the order or the buyer is shared, and no data is shared with any other outside party.

Encryption

• All traffic to our website, app and API uses HTTPS.
• Our database and backups are encrypted at rest with AES-256 by our hosting providers.
• Store and carrier access tokens are additionally encrypted by our application with AES-256-GCM before they are saved. The encryption key is kept in our hosting provider's secret store, separate from our code, and is never shown in the app or written to logs.
• Access tokens are never sent to your browser. The app only ever shows whether a connection is active.

Access control

• Every team member has their own login. Shared logins are not allowed.
• Roles (owner, admin, member and view-only) are enforced by our servers on every request, so each person only sees and does what their role allows.
• Passwords must be at least 12 characters, are checked against known breached-password lists, and are stored only as Argon2id hashes.
• Repeated failed sign-ins are rate limited.
• Our own staff access to production systems requires two-factor authentication and is limited to the people who need it.

Infrastructure

• Nexus Fulfill runs on managed cloud providers in the United States. Databases are not reachable from the public internet without credentials, and production credentials are held only by authorized staff.
• Our website sits behind a web application firewall with protection against denial-of-service attacks.
• The database is backed up automatically to a separate provider, encrypted.
• Test and development environments use separate databases and never contain production customer data.

How long we keep data

• Our Amazon integration is coming soon. Once live, buyer names, addresses and phone numbers received from Amazon are deleted no later than 30 days after the order is delivered, unless a law requires us to keep them longer. Other marketplace data follows the retention periods in our privacy policy.
• When a seller disconnects a store, its access tokens are deleted immediately.
• When an account is closed, its data is deleted within 30 days.

Monitoring and incident response

Sign-ins, failed sign-ins, permission changes and store connections are logged, and unusual activity raises an alert to our team. We keep a written incident response plan. If we discover a security incident affecting your data, we contain it, investigate it, and notify affected sellers and, where required, the marketplace that provided the data, within 24 hours of confirming it.

Secure development

Every change is checked by automated type checks, linting and our test suite, and reviewed and approved by a person before it reaches production. Dependencies and code are scanned for known vulnerabilities, and critical findings are fixed within 7 days.

Report a security concern

If you believe you have found a security issue, email [email protected]. We acknowledge reports within one business day.