Security

Last updated October 17, 2026

ProfitLupa connects to sellers' Amazon and TikTok Shop accounts, so we treat security as part of the product. This page describes what we do, in plain terms. The privacy policy says what data we hold; this page says how we protect it.

Accounts and sign-in

• Passwords are never stored; we keep a salted scrypt hash. Passwords must be at least 10 characters and are checked against a list of common passwords.
• Email verification and password reset use single-use six-digit codes that expire, with a small number of attempts before a new code is required.
• Sign-in attempts are limited per address and per account; repeated failures lock the account for 15 minutes.
• Every login, password change or reset issues a new session key and retires the old one. Session keys are stored only as hashes, so a copy of our database does not contain usable sessions.
• Your account is bound to one device at a time; signing in elsewhere moves it.

Marketplace connections

• You authorize ProfitLupa on Amazon's and TikTok Shop's own pages; we never see or ask for your marketplace password.
• The tokens they give us are encrypted at rest (AES-256-GCM) with a key that lives only in the API's configuration, never in the database or in code.
• We request only the permissions the features need, and we discard buyer personal information (names, addresses, phone numbers, emails) at sync time; it is never written to disk.
• Disconnecting deletes the tokens and all data synced from that account immediately. You can also revoke ProfitLupa from the marketplace side at any time.

The website and API

• Everything is served over HTTPS with HSTS. The site runs under a strict Content-Security-Policy that allows no inline scripts and cannot be embedded in other sites. The only outside scripts are Stripe's payment script, loaded when you pay, and the sign-up form's Cloudflare security check, which runs in a separate frame.
• The API accepts browser requests only from profitlupa.com and the ProfitLupa extension, requires a signed-in session on every endpoint that reads or changes account data (the few public ones, such as sign-in, sign-up and searches someone chose to share as a link, hold none), returns only the requesting account's own data, and rate-limits every route.
• All database access is parameterized; error details are never shown to users.
• Payments are handled by Stripe; card details never touch our servers.

The browser extension

• It runs only on the marketplace sites it supports (Amazon, Walmart, TikTok Shop, Alibaba and eBay, listed in the privacy policy) and on profitlupa.com, and reads public product information there. It holds your ProfitLupa account key but never any marketplace credentials.
• It never clicks, buys, reviews or changes anything on those sites, and can be switched off from its icon at any time.
• Releases are reviewed by the Chrome Web Store before publication.

Operations

• Data is stored in the United States on managed hosting with provider-level firewalls and intrusion prevention. The database is not reachable from the internet.
• Production access is limited to the operator, from encrypted devices, behind multi-factor authentication. The admin console additionally requires an authenticator code and can be locked to fixed addresses.
• Security-relevant events (sign-ins, failed attempts, password changes, connections) are logged and reviewed.
• Dependencies are audited at every release; the operating system, web server and database are patched by the hosting provider.

Incidents and reporting

If we become aware of a security incident affecting your data, we will notify you and the relevant marketplace without undue delay, and no later than 72 hours after confirming a breach of personal data. Found a vulnerability? Email support@profitlupa.com; we acknowledge reports within two business days and don't pursue good-faith researchers.