Copyt Header
Request a Demo

Security Policy

Last updated: October 8, 2026

Copyt Security Overview

Copyt, Inc. (“Copyt”) protects the inventory, order and personal data that resellers, consignors and sales-channel partners trust us with. We follow a written Information Security Policy, approved by our CEO and reviewed at least once a year. This page summarizes how that policy protects your data.

 

Where your data lives

Your data is stored in the United States on Amazon Web Services (AWS) infrastructure, through our managed hosting provider. Copyt is a fully remote company. Our team works from the United States and the Philippines and reaches Copyt systems only through authenticated, encrypted connections. Team members follow our policy and the data protection laws where they work, including the Philippines Data Privacy Act of 2012.

 

Access control

  • Each person on our team gets only the access their role needs. Access to production systems is approved, recorded and reviewed every quarter.
  • Everyone has their own named account. Shared logins are not allowed.
  • Multi-factor authentication is required on every company system that supports it.
  • When someone leaves Copyt, their access is removed within 24 hours.
  • You sign in to Copyt through a dedicated authentication provider. Every request to our API is checked, so each customer can reach only their own account’s data.

 

Encryption

  • All traffic between you and Copyt, and between Copyt and its service providers, uses TLS 1.2 or higher.
  • Databases, backups and file storage are encrypted at rest with AES-256.
  • Access tokens for the sales channels you connect (such as TikTok Shop, eBay, Shopify, StockX and Whatnot) are stored encrypted and requested with the narrowest permissions each integration needs. They are revoked and deleted when you disconnect a channel or close your account.
  • Stripe processes payment cards. Copyt never stores full card numbers.

 

Infrastructure

  • Copyt runs on managed cloud infrastructure and owns no physical servers. Our providers’ data centers supply physical security and DDoS protection.
  • Development, staging and production are kept separate. Customer data is not copied into development or test environments.
  • Our production databases do not accept connections from the public internet.
  • Every Copyt website and service is served only over HTTPS.
  • Production databases are backed up automatically, and backups are encrypted. We test restoring from backup at least once a year.
  • The platform is scanned or penetration-tested by an outside party at least once a year.

 

Secure development

  • Every code change is peer-reviewed and gets a security review before it is merged.
  • Automated tests, code scanning and dependency checks run on every change. A change with a high or critical security finding cannot be merged.
  • Secrets and credentials are kept in encrypted secret stores, never in source code.
  • Vulnerabilities are fixed on deadlines set by severity, and the most serious are fixed first.
  • Releases to production are started deliberately by authorized engineers, not automatically.

 

Monitoring and service status

  • We monitor the availability of our services around the clock and alert an on-call engineer to downtime and errors.
  • Security alerts cover repeated failed logins, new administrator accounts and exposed credentials.
  • Logs are kept for at least 90 days and never contain passwords, tokens or payment data.
  • Live service status, scheduled maintenance and incident history are published at status.copyt.io.

 

Incident response and notification

  • We have a written incident response plan with defined roles, severity levels and response times, and we practice it at least once a year.
  • If your personal data is affected by a security incident, we tell you directly, without undue delay and within any deadline the law sets, along with steps you can take.
  • We notify affected sales-channel partners and regulators as our agreements and applicable law require.
  • Outages and other incidents that affect availability are also posted on our status page.

 

Service providers

Before a provider stores or processes customer data for us, we review its security documentation and data processing terms. When we stop using a provider, its access is removed. Our Privacy Policy describes the kinds of providers we share data with and why.

 

Your data and privacy

  • You can ask to access, correct, export or delete your personal data by emailing support@copyt.io. We complete these requests within 30 days of verifying your identity.
  • When your relationship with Copyt ends, your data is deleted from our production systems within 90 days, unless the law requires us to keep it.
  • Copyt has an appointed Data Protection Officer who oversees how we handle personal data.
  • Our Privacy Policy and Terms of Use give the full details.

 

Reporting a security issue

If you believe you have found a security vulnerability in Copyt, email security@copyt.io. Please include enough detail for us to reproduce it, and give us a reasonable time to fix it before sharing it publicly. Please do not access, change or delete data that isn’t yours while testing.

 

Contact