Security

# Security

What we can reach, what we cannot, and what we have not certified.

WHAT WE READ
:   public pages only

YOUR SITE
:   we suggest, you approve

SECURITY CONTACT
:   [security@rewalto.com](mailto:security@rewalto.com)

## The short version, before the detail.

Security and data-handling posture

| Area | Where we stand |
| --- | --- |
| Write access to your site | Proposals only. A pull request on your repo or a staged edit on your store. No merge path exists in the product and no setting adds one. The permission a pull request needs is broader than that, so the control is the absent code rather than the narrow scope. |
| Write access to a retailer | None, permanently. We change nothing on a marketplace or retailer property. |
| What we crawl | What is publicly reachable. Nothing behind a login, and nothing we were not given as a target. |
| Where data lives | India for the database: Supabase, on AWS in Mumbai (ap-south-1). Page captures are kept in Cloudflare R2, S3-compatible object storage. Our crawlers and services run on Fly.io in Singapore. |
| Encryption | Encrypted in transit with TLS, and at rest with AES-256 — by Supabase for the database and by Cloudflare R2 for page captures. |
| Access control | Row-level security on every table, deny by default. Secrets in the platform's secret store, never in code. |
| Sub-processors | Listed in the privacy notice, named rather than described. |
| Retention | Public listing evidence — the prices and page captures we collect — is kept without expiry, because a price history cannot be rebuilt later. Working files expire, and anything that identifies a person carries an expiry the system enforces. Enquiry details are deleted after 180 days. |
| Certifications | **None held.** Not SOC 2, not ISO 27001. We will say so here on the day that changes. |
| Reporting a vulnerability | [security@rewalto.com](mailto:security@rewalto.com) |

## Three kinds of data, and they are not equally sensitive.

### Your public surface.

Pages we crawled, listings we read, and answers assistants gave. All of it is public and we store it whole, hashed and timestamped, because a figure that cannot resolve to its capture is not evidence.

### Your account.

The people who log in, and what they did. Ordinary, and the smallest of the three.

### Your repository access, if you granted it.

Scoped to the repositories you name, used to open pull requests, and revocable by you without asking us.

**Rewalto has no merge path.** No code in the product calls GitHub's merge endpoint. The connector's only write operations are create a branch, commit to it, and open a pull request. The guarantee is the absence of the code rather than the absence of the permission, and if you want the permission gone too, branch protection on your side is what does it.

## Questions about how we handle your data?

Ask us directly, and you’ll hear back within one working day.

[Contact us](https://rewalto.com/contact)