How we protect your account and your Amazon data.
What is in place today, and what is not.
Signing in
- Passwords of at least 12 characters, stored as one-way bcrypt hashes.
- Temporary lock after 10 wrong attempts.
- Two-step sign-in with an authenticator app and single-use recovery codes.
- The session cookie is HttpOnly, rotates on use and is revoked if a copy is detected.
- Changing the password signs out other devices.
Your data
- TLS 1.2+ in transit; encrypted server disk.
- Amazon access keys and two-step secrets encrypted again in the application (AES-256-GCM).
- Every request checked so users see only their workspace, with automated cross-workspace tests.
- No buyer personal data stored.
- Logs without passwords or keys.
- Daily server snapshots kept 7 days.
Access to Amazon
- You approve on Amazon's own page and we never see your Amazon password.
- The connection request is bound to the browser and user that started it.
- Disconnecting deletes the keys at once.
- Read-only toward Amazon.
Operations (test environment)
- One server on Amazon Web Services.
- The database and cache are not exposed to the internet.
- Secrets in a managed secrets store.
- Two-step sign-in required for every account.
- We report incidents affecting Amazon data to Amazon within 24 hours.
What we do not have yet
- An independent penetration test.
- Certifications such as SOC 2 or ISO 27001.
- A multi-server production setup with automatic failover.
- A tested restore drill.
We will publish them here when they exist.
Report a vulnerability
E-mail info@druza.net. We reply within one business day.