Security

Marketplace credentials

Your Trendyol API key and secret, Hepsiburada username, password and service key, n11 app key and secret, and eMAG username and password are encrypted with AES-256-GCM before they are written to the database. On Amazon you never enter a password: you grant access on Amazon's own consent page, and Riseluc stores only the refresh token Amazon issues, encrypted the same way.

The encryption key is not in the database; it lives only in the servers' environment variables, and every value is encrypted with a random initialisation vector. Encrypted fields cannot be read from the browser: the database role the dashboard uses cannot see them at all, and only the server side that connects to the marketplace decrypts them.

You can renew a store connection with new credentials or delete the store from the dashboard. Regenerating the key, changing the password or removing the app's access in the marketplace's seller panel also cuts off Riseluc's access.

Where your data is kept

Riseluc's infrastructure runs on three providers:

• Database and sign-in: Supabase, Frankfurt region in the European Union.
• Website and dashboard: Vercel; server-side processing runs in the Frankfurt region.
• Background jobs (marketplace sync, repricing, reports): Railway.
• Connections use HTTPS only (HSTS); the site cannot be opened inside another site's frame, and a content security policy (CSP) is applied.

• Privacy Policy: third-party services
• System status

Protecting your account

• Sign-in is handled by Supabase's authentication service; your password is stored there as a one-way hash, and the Riseluc team cannot see it.
• Two-step verification (a 6-digit code from an authenticator app) is turned on in Settings, and you get backup codes during setup. While it is on, the dashboard does not open without the second step, and requests that write prices or stock or add store credentials ask for it too.
• You give team members a role: viewers can only read; inviting and removing members and changing store settings belong to owners and admins. The viewer's write block is also enforced in the database.

Who can access your data

• Row-level security (RLS) is on for the database tables: a request from the browser can only read rows that belong to your account and your team's stores.
• No one can change billing fields such as plan, subscription status and period end from the browser; only the server side writes them (a notification from the payment provider or a logged admin action).
• On the Riseluc team, only authorised admins can open the admin panel, and two-step verification is mandatory for them. Admin changes, and an admin's views of a user, a store or a support conversation, are written to a separate audit log together with the admin's address; this log cannot be read or changed from the browser.

When Riseluc writes to a marketplace

• Repricing and automatic stock updates are off by default; no automatic price or stock is written to the marketplace until you turn them on.
• Repricing never writes a price below the calculated floor price, and it leaves products whose floor cannot be calculated untouched.
• In bulk price and stock editing you preview the changes before they are sent, and Lucy's suggestions never reach the marketplace without your approval.
• Supplier XML links are only fetched from public http and https addresses; local network, private IP and cloud metadata addresses are rejected both when the link is saved and when it is fetched.
• Actions such as store verification, marketplace writes and file uploads have per-account request limits.

AI and connected apps

An AI provider is used for product text and translation, draft replies to customer questions, review analysis, matching the columns of a supplier XML file and Lucy's answers. When you ask Lucy a question, the store data needed for the answer (for example a profit summary, order or stock details) is sent to this provider. Your marketplace credentials, password and payment details are never sent. The data sent for the other AI features is listed item by item in the Privacy Policy.

You connect ChatGPT or Claude to your Riseluc account with OAuth; your password is never given to the app. The connection is read-only: it cannot change prices, stock, orders or listings, and it sees only the stores you select on the consent screen; an app cannot widen its own access. A short record of each tool call (app, store, tool name, result and duration; not the content of your question or the answer) is kept for 90 days. When you remove access under Settings → AI apps, the app's next request is refused.

• ChatGPT and Claude connection
• Privacy Policy

Riseluc Radar extension

The Riseluc Radar Chrome extension is not linked to your Riseluc account and makes no network requests of its own: it does not send what it reads from the page or what you type to Riseluc or any other server. The values you type are stored only in your browser, and the content of cart, order and account pages is not read. Because the panel is shown inside the marketplace's page, that page's own scripts can technically see the values you type.

• Riseluc Radar privacy policy

Retention and deletion

You can delete a store yourself from the dashboard; that store's product, order and financial records are deleted. To close your account, send a request under Settings → Closing your account: our team first cancels your subscription if you have one, then deactivates or permanently deletes the account.

Which records remain after deletion, for what purpose and for how long (for example the abuse-prevention record, the free-trial record and the sales summary archive) is set out in the Retention Period section of the KVKK Privacy Notice.

• KVKK Privacy Notice
• Privacy Policy

Reporting a vulnerability

If you find a security vulnerability, please write to info@riseluc.com before sharing it publicly. The affected address or screen, the steps to reproduce it and a screenshot if you have one are enough.

When testing, use only your own account and your own store; do not try to access other users' data, delete data or slow the service down. This address is also listed in the site's security.txt file.

• security.txt

Scope of this page

This page describes the measures in place at Riseluc today and is updated when they change. Riseluc does not hold a security certification audited by an independent body (such as ISO 27001 or SOC 2). We take reasonable technical and organisational measures; even so, no system is absolutely secure.