TONOYAN AIMarketplace tokens
Wildberries API tokens are encrypted with authenticated encryption and decrypted only inside backend requests. The browser receives a masked value and the connection status, never the raw token.
Authentication and sessions
Passwords are stored as salted, memory-hard Argon2id hashes. Session identifiers and CSRF values are stored as hashes. Cookies are HttpOnly, Secure and SameSite. Sessions have idle and absolute expiry and can be revoked from Account Security. Multi-factor authentication with an authenticator app, recovery codes or passkeys is available, and changing a factor revokes all other sessions.
Tenant isolation
Workspaces, seller accounts and memberships are checked server-side on every request. Roles (Owner, Admin, Manager, Analyst, Finance, Viewer) are never trusted from browser input.
Read-only marketplace boundary
The service reads marketplace data through official APIs and does not execute price, advertising, catalog, stock or supply changes on the marketplace. Recommendations are yours to apply.
Operations
Health checks, structured request logs, rate limiting, audit logs of security-relevant actions, database backups and least-privilege infrastructure access are in place. Connections are served over HTTPS with strict transport security.
Reporting a security issue
If you find a vulnerability, contact support by email with a description and reproduction steps. Please do not publish details before we have had a chance to respond.