Security at ProfitWire

Effective Date: October 12, 2026

ProfitWire looks after sensitive business information for you: sales history, cost basis, marketplace connections and financial reports. This page explains in plain terms how we protect that information today, which protections come from our service providers, and where we are still improving.

This page is written and maintained by ProfitWire LLC. It is not a third-party certification. ProfitWire does not currently hold SOC 2, ISO 27001 or any other security certification.

1. Secure Connections and Encryption

Every connection to ProfitWire uses HTTPS. Unencrypted requests are redirected, and browsers are told to use HTTPS only.
We set browser security protections that limit where the app can load content from and stop other websites from embedding ProfitWire.
Provider protection: our database and file-storage provider encrypts stored data at rest as part of its managed service.
ProfitWire protection: we encrypt marketplace access tokens (for example, eBay's) ourselves before storing them, and we never send them to your browser.

2. Signing In

Provider protection: sign-in is handled by a managed authentication provider. Passwords are stored only in hashed form; ProfitWire never sees or stores your plaintext password.
Provider protection: password reset links are issued by our authentication provider and expire.
Provider protection: our authentication provider limits repeated sign-in requests.
You can sign in with Google instead of creating a ProfitWire password.
ProfitWire protection: you must confirm you own your email address before you can connect a marketplace or start a paid plan.

3. Keeping Each Account's Data Separate

Every account's data is protected by database access rules, so one account cannot read or change another account's records.
Every request that reads or changes your data is checked on our servers, not only in the app's screens.
Administrative permissions are stored separately on our servers and are never accepted from your browser.
Records that hold marketplace connection credentials cannot be read directly from any browser.

4. Where ProfitWire Runs

The application runs on Cloudflare's network.
Our database, sign-in, file storage and scheduled background jobs run on a managed cloud database platform.
Card payments are processed by Stripe, and Android app subscriptions by Google Play. ProfitWire never receives or stores your full card number.
Our pre-release preview environment currently uses the same managed database as the live service. Only ProfitWire can use the preview, and it follows the same database access rules. Fully separating these environments is on our improvement plan.

5. Marketplace Connections

We connect to marketplaces only through their official authorization flows. We never ask for your marketplace password or API keys.
Connection credentials are exchanged and stored on our servers, encrypted, and never returned to your browser.
You can disconnect eBay from ProfitWire on the web or in the mobile app. Disconnecting stops future syncing and deletes the eBay access credentials stored by ProfitWire; your inventory, purchases, sales and financial history stay available. To remove ProfitWire's authorization directly at eBay, revoke access in your eBay account settings.
Connections disconnected before October 2026 used an earlier process that stopped syncing but did not delete the stored credentials.
When you delete your ProfitWire account, we erase your stored marketplace access tokens.

6. Monitoring and Day-to-Day Security

Application errors are captured and reviewed through our error-monitoring tools.
Scheduled health checks confirm that sign-in and our background services are running.
Our background jobs reject requests that don't come from our own scheduler.
Service passwords and keys are kept in a secure secret store, never in our source code.
Code changes pass automated type checks, tests, code-quality checks and a full production build before release. Software dependency versions are locked, so every build uses the same reviewed set.
We do not currently run automated alerts for suspicious sign-in activity. Adding them is on our improvement plan.

7. Backups and Recovery

Provider protection: our database provider makes automated backups as part of its managed service.
We keep a written restore procedure. We haven't yet completed a full test restore, so we don't promise a specific recovery time or recovery point.

8. Keeping and Deleting Your Data

We keep your data while your account is active, and afterward only as described in our Privacy Policy.
You can request a copy of your data, or its deletion, on our Data Requests page. You can start account deletion from your account settings or at /delete-account.
When you delete your account, we end your active sign-in sessions and erase your stored marketplace access tokens.

9. Security Incidents

We keep written procedures for finding, containing, investigating and recovering from security incidents. If an incident affects your personal data, we will notify you as required by applicable law.

10. Reporting a Security Issue

We welcome reports of possible security vulnerabilities. Please email support@getprofitwire.com with "SECURITY" in the subject line, and include a description, the steps to reproduce it and any relevant times.

When reporting:

don't access, change or delete data that isn't yours;
don't run denial-of-service attacks or high-volume automated scanning against the live service;
give us reasonable time to look into and fix the issue before sharing it publicly.

This page doesn't authorize any testing of ProfitWire systems.

If you think your account has been compromised, contact us right away at the same address.

11. Limits and What We're Improving

No system is perfectly secure, and we don't guarantee that incidents will never happen. Our current improvement plan:

fully separate pre-release and live data;
add request limits to our own services;
add security alerts;
verify a full restore from backup.

We'll update this page as we complete each item.