Hero
Practices
- Encryption in transit (TLS) and at rest
- Channel credentials stored separately from application data
- Role-based access (Admin, Buyer, View-only)
- Full audit log of forecast changes, POs, settings and AI-drafted actions
- Built to align with Amazon’s Data Protection Policy for Selling Partner API data
- Shopify: only the scopes we need; mandatory GDPR webhooks implemented for App Store apps
- Account export to CSV at any time; deletion on request per privacy policy
Subprocessors
Listed in the privacy policy and DPA. [Placeholder — final list before launch]
CTA
Read privacy policy · Read DPA · Contact security@[domain]