What we actually do to protect your data
Specific controls rather than reassuring adjectives. If something is not listed here, we do not claim it.
Encrypted in transit
Every connection to SellTrove uses TLS. Stores are served over HTTPS with certificates issued and renewed automatically, including on merchant custom domains.
Card data never touches our servers
Card payments are handled by licensed payment providers. SellTrove does not receive or store full card numbers.
Tenant isolation
Every query against merchant data is scoped to that merchant. Storefront sessions are scoped to a single store address rather than shared across the platform, so one merchant's storefront cannot read another's customer sessions.
Access control
Staff accounts get role-based permissions. Someone fulfilling orders does not see payout details or cost prices.
Audit logging
Significant actions are recorded with who performed them and when, which is what makes an incident investigable rather than guessable.
Backups
Databases are backed up on a schedule and retained, with restores tested rather than assumed.
Reporting a vulnerability
Send findings to security@selltrove.ng with enough detail to reproduce the issue. We will acknowledge your report and keep you updated while we fix it.
Research carried out in good faith — no data exfiltration, no service disruption, no access to other people's accounts — will not be met with legal action. Please give us a reasonable window to fix an issue before publishing it.
Your data rights
What data we hold, why, and how to get it or delete it is set out in the Privacy Policy. The terms covering data we process on a merchant's behalf are in the Data Processing Terms.