Security Policy

Every seller's listings, credentials, logs and billing records are scoped to their own account and enforced at the database layer, so one account cannot read another's data.

Access to production systems is limited to the people who need it to operate the service.

Authentication is handled by our managed auth provider, including hashed credentials and optional Google sign-in.

When you choose Fairclose sign-in, Crossflo temporarily processes your password on its server and forwards it to Fairclose over HTTPS. Crossflo never stores the password. It saves encrypted session tokens only after Fairclose verifies your seller identity.

Previously saved Fairclose credentials remain encrypted and are not sent. Fairclose publish and delist happen only when you press them, after sign-in and a passed readiness check; imports and sale checks only read; nothing syncs automatically.

If you believe you have found a security issue, please report it through the contact page with enough detail to reproduce it, and give us a reasonable window to fix it before disclosing publicly. We will not pursue action against good-faith research that avoids privacy violations and service disruption.