ResaleSonar protects your data with encryption in transit and at rest, least-privilege access controls, isolated infrastructure, regular encrypted backups, and disciplined dependency patching. Payments are handled by a PCI-compliant processor, we never store full card numbers. If you find a security issue, email security@resalesonar.com and we'll respond quickly. This page describes our practices in plain terms so you can decide whether ResaleSonar is a safe place for your reselling business.
Encryption in transit
Every connection to ResaleSonar: the marketing site, the app at app.resalesonar.com, and our internal APIs, is served over HTTPS using TLS. Traffic between your browser and our servers is encrypted so that prices, product data, and credentials can't be read or tampered with on the wire. We use HTTP Strict Transport Security (HSTS) to tell browsers to refuse insecure connections, and we redirect any plain HTTP request to its secure equivalent.
Encryption at rest
Your data: tenant catalogs, tracked sites, collected observations, and account records, lives in a database with encryption at rest. Sensitive secrets are handled with particular care: credentials and third-party API keys used by the collection engine are encrypted before they're stored, not kept in plaintext. Backups are encrypted too, so a copy of your data is never sitting around unprotected.
Access controls and least privilege
Access to production systems and customer data is restricted to the small number of people who genuinely need it to operate and support the service. We follow the principle of least privilege: accounts get the minimum access required for their role, and administrative access to infrastructure is limited and guarded.
Inside the product, your workspace is multi-tenant with strict isolation: one tenant cannot see or reach another tenant's products, sites, or observations. Team roles (Owner, Admin, and standard members) gate who can change billing, edit team membership, and manage sensitive settings, so you control what your own staff can do.
- Least-privilege access to production and customer data
- Per-tenant data isolation enforced in the application and data layer
- Role-based permissions inside your workspace (Owner / Admin / member)
- Encrypted secrets for collection credentials and API keys
Isolated infrastructure
ResaleSonar runs on dedicated, hardened server infrastructure rather than shared consumer hosting. The application and its data store run in a controlled environment behind a firewall that only exposes the ports the service actually needs. Administrative access to the servers uses SSH keys, not passwords, and is locked down to trusted access paths. Our price-collection engine, which reaches out to marketplaces on your behalf, is guarded against being pointed at internal or private network addresses, so it can't be abused to probe systems it shouldn't touch.
Backups and recovery
We take regular, encrypted backups of your data so that a failure, mistake, or incident doesn't mean losing your catalog and history. Backups are stored securely and separately from the live database. We keep restore images and a documented rollback path so we can recover quickly and cleanly if something goes wrong during a deploy or an outage.
Dependency and patching hygiene
Most real-world breaches ride in on an out-of-date dependency, not a clever zero-day. We keep our software stack: the framework, libraries, database, and operating system packages, reasonably current and apply security updates promptly. Our build pipeline includes automated checks, and we periodically run internal security review passes over authentication, input handling, and the parts of the system that fetch external data. When we find something, we fix it and look for the same class of issue elsewhere in the codebase.
Payments and card data
Billing is handled by a PCI-compliant third-party payment processor. Your card details are entered directly with the processor and tokenized: ResaleSonar never sees or stores your full card number, CVC, or full bank details. We keep only what we need to manage your subscription, such as a plan reference and the processor's customer and subscription identifiers. This keeps the most sensitive financial data out of our systems entirely, where it's safest.
Authentication and account security
Accounts are protected by modern authentication with securely hashed passwords, we never store passwords in plaintext. Sessions are managed with secure, HTTP-only cookies, and state-changing actions are protected against cross-site request forgery. Multi-factor authentication and self-serve account deletion are supported so you stay in control of access to your workspace. We recommend using a strong, unique password and enabling MFA for every member of your team.
Responsible disclosure
If you're a security researcher, or just a sharp-eyed reseller who spotted something, we want to hear from you. Email security@resalesonar.com with enough detail to reproduce the issue, and we'll acknowledge it and work with you on a fix. We ask that you give us a reasonable window to remediate before any public disclosure, and that you avoid accessing or altering other people's data, degrading the service, or running disruptive automated tests against production while you investigate. Good-faith research reported this way is welcome.
Your part in keeping data safe
Security is a shared job. The strongest infrastructure in the world can't protect an account with a reused, guessable password. A few habits go a long way:
- Use a strong, unique password and a password manager
- Turn on multi-factor authentication for every team member
- Give teammates the least access they need: reserve Owner and Admin for people who truly need them
- Remove access promptly when someone leaves your team
- Be cautious with the third-party credentials you connect to the collection engine
Want to know how we handle the data itself, not just how we protect it? Read our privacy policy and terms of service. You can also check current uptime on our system status page or learn more about the company on About ResaleSonar.