Security

Encryption

• In transit: All connections use TLS 1.2 or higher. HSTS is enforced with preload, includeSubDomains, and a two-year max-age.
• At rest: Commercially sensitive fields (cost of goods, sale prices, removal fees, recovery amounts) are encrypted using AES-256-GCM with per-user encryption keys via envelope encryption. Each user's data is encrypted with a unique data encryption key (DEK), which is itself encrypted by a master key.
• Passwords: Hashed using bcrypt. Never stored in plaintext.
• API keys: Hashed using bcrypt. The plaintext key is shown once at creation and never stored.

Access control

• Row-level security: PostgreSQL row-level security (RLS) policies enforce that each user can only access their own data at the database level.
• Session management: A session version is checked against the database on every request. You can stay signed in on several devices at once (for example a laptop and a phone), except on internal claims-specialist logins, where a new sign-in signs out the account's other devices. Password changes and resets, two-factor recovery, email changes and “Sign out all other devices” sign every other device out of ReclaimHQ on its next request, and a device that signed in before the change cannot resume its session. Password changes, resets and “Sign out all other devices” also revoke those devices' sessions at the authentication server.
• Password policy: Minimum 12 characters, requires uppercase, lowercase, digit, and special character. Common passwords are blocked. Passwords expire after 365 days.
• Multi-factor authentication: TOTP-based two-factor authentication via authenticator apps (Google Authenticator, Authy, 1Password, etc.) is required at sign-in by default, and always for our claims specialist. A small number of named logins are exempt; each exemption is set by hand and recorded.
• Progressive lockout: Failed login attempts trigger escalating cooldowns (60 seconds after 5 failures, up to 1 hour after 20 failures).
• Login risk engine: Automated risk assessment on every login. Medium-risk logins require email verification. High-risk logins are blocked with an alert.

Network and application security

• Content Security Policy: Strict CSP headers restrict script sources, frame ancestors, and external connections.
• CSRF protection: Origin validation on all state-changing requests. Trusted origins are explicitly allowlisted.
• Rate limiting: All sensitive routes are rate-limited by user and/or IP address using sliding window algorithms.
• Security headers: X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Cross-Origin-Opener-Policy same-origin, Permissions-Policy restricting browser features.
• Cache control: Authenticated responses include Cache-Control: private, no-store to prevent caching of sensitive data.

Audit logging

• All authentication events, data mutations, permission changes, and administrative actions are recorded in an append-only audit log.
• Audit entries are protected by a SHA-256 integrity chain to detect tampering.
• Logs are retained for at least 12 months.
• Automated alerts are raised for suspicious patterns including repeated failed logins, origin validation failures, and sensitive operation abuse.

Data handling

• Amazon Marketplace data is permanently deleted within 30 days of the earliest of: the account's subscription ending, its Amazon API connection being removed (in ReclaimHQ or in Seller Central) with no other Amazon connection left, a deletion request, account closure, or a notice from Amazon. A scheduled process enforces this several times a day and records each deletion in the audit log.
• Deleted data leaves our encrypted database backups as they are replaced, within the same 30 days. The only records kept longer are the billing records UK tax law requires (six years) and our security audit log (at least 12 months), which can include Amazon order, case or reimbursement IDs.
• Inventory ledger records more than 18 months old are deleted automatically for every account.
• eBay postage labels and packing slips, which carry buyers' names and addresses, are deleted 90 days after dispatch.
• Payment processing is handled entirely by Stripe. We do not store card details.
• Server-side error logs never contain email addresses, passwords, tokens, or API keys.
• Client-facing error messages never expose internal system details or third-party error messages.

Incident response

• We notify the ICO (Information Commissioner's Office) within 72 hours of becoming aware of a personal data breach where UK GDPR requires it, and affected users without undue delay.
• Security incidents involving Amazon Information are reported to Amazon at security@amazon.com within 24 hours of detection.
• We follow a written breach procedure, reviewed after every incident and at least every six months.

Infrastructure

• Hosting: Vercel (serverless, edge network).
• Database: Supabase (managed PostgreSQL with row-level security).
• Secrets scanning: Automated secret scanning runs on every push via GitHub Actions (Gitleaks).
• Dependency scanning: Automated dependency vulnerability scanning runs on every push, pull request, and weekly via GitHub Actions.

Contact

To report a security vulnerability or ask a security question, email hello@reclaimhq.uk. Other ways to reach us are on our contact page.