Security
What we can reach, what we cannot, and what we have not certified.
- WHAT WE READ
- public pages only
- YOUR SITE
- we suggest, you approve
- SECURITY CONTACT
- security@rewalto.com
The short version, before the detail.
| Area | Where we stand |
|---|---|
| Write access to your site | Proposals only. A pull request on your repo or a staged edit on your store. No merge path exists in the product and no setting adds one. The permission a pull request needs is broader than that, so the control is the absent code rather than the narrow scope. |
| Write access to a retailer | None, permanently. We change nothing on a marketplace or retailer property. |
| What we crawl | What is publicly reachable. Nothing behind a login, and nothing we were not given as a target. |
| Where data lives | India for the database: Supabase, on AWS in Mumbai (ap-south-1). Page captures collected before October 2026 are kept in Cloudflare R2, S3-compatible object storage; data collected since then keeps no copy of the page. Our crawlers and services run on Fly.io in Singapore. |
| Encryption | Encrypted in transit with TLS, and at rest with AES-256: by Supabase for the database and by Cloudflare R2 for page captures collected before October 2026. |
| Access control | Row-level security on every table, deny by default. Secrets in the platform's secret store, never in code. |
| Sub-processors | Listed in the privacy notice, named rather than described. |
| Third-party connectors | Read-only by default. A connector’s credential sits in the same vault as everything above and is substituted at the point of use, never copied into application code (P7-01). What each connector reads, what it can never do, and how to revoke it is on its own page under /integrations, not restated here. |
| Retention | Public listing data is kept without expiry, because a price history cannot be rebuilt later. Since October 2026 each record keeps the source address, the time it was read, a SHA-256 hash of what was read and a short excerpt of the text the figure came from, never the page itself. Page captures collected before October 2026 stay in Cloudflare R2 without expiry. Working files expire, and anything that identifies a person carries an expiry the system enforces. Enquiry details are deleted after 180 days. |
| Certifications | None held. Not SOC 2, not ISO 27001. We will say so here on the day that changes. |
| Reporting a vulnerability | security@rewalto.com |
Three kinds of data, and they are not equally sensitive.
Your public surface.
Pages we crawled, listings we read, and answers assistants gave. All of it is public and we store it whole, hashed and timestamped, because a figure that cannot resolve to its capture is not evidence.
Your account.
The people who log in, and what they did. Ordinary, and the smallest of the three.
Your repository access, if you granted it.
Scoped to the repositories you name, used to open pull requests, and revocable by you without asking us.
Rewalto has no merge path. No code in the product calls GitHub's merge endpoint. The connector's only write operations are create a branch, commit to it, and open a pull request. The guarantee is the absence of the code rather than the absence of the permission, and if you want the permission gone too, branch protection on your side is what does it.
Questions before you start
Can Rewalto change anything on a retailer or marketplace?
No. Rewalto has no write access to any marketplace or retailer property, and that is permanent.
Where is Rewalto's data stored?
The database is in India: Supabase, on AWS in Mumbai (ap-south-1). Page captures collected before October 2026 are kept in Cloudflare R2. Both are encrypted in transit with TLS and at rest with AES-256.
Does Rewalto hold SOC 2 or ISO 27001?
No. Rewalto holds no security certification yet, and this page will say so on the day that changes.
How do I report a vulnerability?
Email security@rewalto.com.
Questions about how we handle your data?
Ask us directly, and you’ll hear back within one working day.