Security

Email hello@spillmark.com with the subject "Security report". This covers security vulnerabilities, suspected misuse of data from Amazon or Meta, and privacy concerns.

Please include:

• What you found and where (URL, feature, or account).
• Steps to reproduce it, if it's a vulnerability.
• How we can reach you for follow-up.

Please don't access, change, or delete data that isn't yours while investigating, and give us a reasonable chance to fix an issue before disclosing it publicly.

1. We acknowledge your report within 2 business days and give it a tracking reference.
2. We investigate, contain any risk, and keep you updated until it's resolved.
3. If customer data or data from Amazon or Meta may be affected, we notify affected customers and the relevant platform. Incidents involving Amazon data are reported to Amazon within 24 hours of detection.
4. We record the incident, its cause, and the fix, and review our controls afterward.

• Data is encrypted in transit (TLS) and at rest.
• Each customer's data is kept separate and is never shared with or used for other customers.
• We request read-only access and only the data needed to run Spillmark. We don't collect buyer names, addresses, emails, or phone numbers.
• Access to systems and credentials is restricted and protected with multi-factor authentication.
• Uploaded report files are read once and deleted straight away; only the fields Spillmark needs are kept.
• Data from a connected account is deleted within 30 days of disconnecting it. A brand owner can delete the brand and all its data from Settings.