Security Practices

Ecom Intelligence is operated by ROA BUSINESS SOLUTIONS LLC.

The security of your account and data is a priority. This summary describes, at a high level, the technical and organizational measures we apply.

1. Encryption

All communication between your browser and our servers is encrypted (HTTPS/TLS). API keys and secrets are kept exclusively on the backend. Third-party integration tokens (Shopify, Meta) are encrypted at rest before being stored in the database. Service credentials are never exposed to the browser.

2. Per-account isolation

Every database read and write is scoped by your user identifier, workspace, and, where applicable, productId. No account can read or modify another account's data. Access controls are enforced from the server, never from the client alone.

3. Authentication

Authentication is handled via signed Supabase Auth tokens, validated on every request to the server. Admin permissions are determined only from the database, never from the client.

4. Usage limits and abuse protection

We apply per-account request and AI usage limits to prevent abuse, brute-force attacks, and excessive consumption of shared resources. Private or signed URLs are used for sensitive assets where implemented.

5. Backups

We deactivate your account immediately after a deletion request and promptly remove its live data. Remaining account data, including backup copies, is deleted within 30 days. Only records that applicable law requires us to retain are kept, and only for the legally required period.

6. Vulnerability reporting

If you discover a security vulnerability, please report it responsibly to info@ecomintelligence.ai before disclosing it publicly. We will investigate and respond as soon as possible.

7. Limitations

No method of transmission or storage is completely secure. We work to protect your data, but cannot guarantee absolute security.