Venda.

Information Security Policy

Effective date: August 2026  ·  Version 1.1

1. Our Commitment

Venda maintains an information security program designed to protect the confidentiality, integrity, and availability of customer data and all data processed through our platform, including data obtained via third-party marketplace API integrations.

Venda is a founder-operated product currently in beta. This policy applies to every system that stores, processes, or transmits customer data, and to anyone who accesses that data on Venda's behalf. It is reviewed and updated as the product and its security posture evolve.

2. Infrastructure and Hosting

Venda is built entirely on SOC 2-certified cloud infrastructure. We do not operate physical servers.

  • —Vercel — Application hosting, edge network, and DDoS protection
  • —Supabase — PostgreSQL database and file storage (AWS-backed, us-east-1)
  • —Clerk — Authentication and identity management

Each provider maintains independent security certifications, penetration testing programs, and compliance controls, which Venda inherits as a customer. All customer and API partner data is stored and processed in the United States.

3. Data Encryption

3.1 Data in Transit

  • —All data transmitted between clients and Venda systems uses TLS 1.2 or higher
  • —HTTP connections are automatically redirected to HTTPS
  • —API communications with marketplace partners use TLS-encrypted connections at all times

3.2 Data at Rest

  • —All database data encrypted at rest using AES-256 (Supabase / AWS)
  • —File storage (listing images, attachments) encrypted at rest in Supabase Storage
  • —Backups encrypted using the same standard

3.3 Secrets and Credentials

  • —API keys, OAuth secrets, and database credentials stored as environment variables in Vercel's encrypted secrets management
  • —Secrets are never committed to source code repositories
  • —Secret rotation is performed upon personnel departure or suspected exposure

4. Access Controls

4.1 Principle of Least Privilege

Access to all systems and data is granted on the basis of minimum necessary access required to perform a job function. No individual or system component receives more access than is required.

4.2 Authentication

  • —Multi-factor authentication (MFA) is enabled on every service that holds customer or API partner data
  • —MFA is enabled on GitHub, Supabase, Vercel, the Clerk dashboard, and all cloud provider consoles
  • —Credentials are unique per service and stored in a password manager
  • —Credentials are never shared or committed to source control

4.3 Database and Application Layer

  • —Private API endpoints require valid authentication — a Clerk-issued session token for the web and mobile apps, or a scoped device token for the desktop app
  • —A small number of endpoints are intentionally public (marketplace webhooks, one-time desktop activation) and are verified by cryptographic signature or a single-use code rather than a user session
  • —The mobile and desktop apps connect to the database with a public, publishable key that carries no privileges of its own; every table holding user data is protected by Row-Level Security (RLS) policies scoped to the authenticated user, so a user can only read or write their own data
  • —Privileged database credentials (service-role keys) are stored as encrypted environment variables and are never shipped in client apps or committed to source code

4.4 Access Reviews

  • —Production access is limited to the founder
  • —Any third-party or contractor access is granted only for the task at hand and revoked as soon as it is no longer needed
  • —Accounts with production access are reviewed periodically

5. Third-Party API Data Handling

Venda integrates with third-party marketplace APIs (including eBay, Etsy, and Shopify) to provide listing management and cross-platform publishing services, and connects to additional marketplaces (Poshmark, Mercari, Depop, Facebook Marketplace, Grailed, and Whatnot) through your own authenticated sessions. Data received through these integrations is handled as follows:

  • —API data is classified as Confidential and subject to the same security controls as all customer data
  • —Stored only in encrypted Supabase database — never in plaintext
  • —Accessible only to the authenticated seller to whom it belongs, enforced via Row-Level Security
  • —Never sold or shared with unauthorized third parties
  • —Used solely for the purpose for which it was obtained (marketplace listing management)
  • —Deleted within 30 days upon termination of the API relationship or upon user request
  • —All API credentials scoped to minimum required permissions and stored in encrypted environment variables
  • —Venda complies with all data handling requirements stipulated in each provider's developer agreement

6. Vulnerability Management

6.1 Dependency Scanning

  • —Automated dependency vulnerability alerts (GitHub security alerts / Dependabot) are enabled on the code repositories
  • —Security advisories are reviewed regularly
  • —Security-critical dependency updates are prioritized and applied promptly

6.2 Code Review

  • —Changes are gated by automated checks (type-checking, contract guards, and CI) before reaching production
  • —Security implications are considered for every change
  • —Production deploys run through the same automated checks — no unverified changes ship

6.3 Infrastructure

  • —Infrastructure patching managed by SOC 2-certified cloud providers
  • —Vercel edge network provides DDoS protection and anomalous traffic detection
  • —Per-user rate limiting caps request volume, and expensive operations are additionally bounded by usage quotas

7. Incident Response

Venda maintains a formal incident response process for identifying, containing, and recovering from security incidents. In the event of a confirmed breach involving personal data or API partner data:

  • —Affected users notified within 72 hours via their registered email address
  • —API partner notification within 72 hours of confirmed breach, or sooner if contractually required
  • —Regulatory authorities notified within legally mandated timeframes where applicable

To report a suspected security vulnerability or incident, contact us at support@venda-list.com.

8. Endpoint Security

  • —Full-disk encryption on work devices (FileVault / BitLocker)
  • —Automatic screen lock after a short period of inactivity
  • —Operating-system and security patches applied promptly
  • —Anti-malware protection active on work machines

9. Contact

Questions about this security policy or Venda's security program:

  • —Security contact: support@venda-list.com
  • —Joe Maio, Founder & CEO — Data Protection and Security Responsibility
  • —Website: venda-list.com

Last updated: August 2026. Approved by Joe Maio, Founder & CEO.