What we do with your data
Short and verifiable. If something is missing here, ask and we will answer with specifics.
Shopper names and addresses are never stored
Names, street addresses, cities, full postal codes, phone numbers and shopper emails are dropped while the invoice is parsed, before anything reaches the database. What survives are 3PL identifiers (order number, SKU, warehouse, carrier) and, for each shipping label, its destination country and the first three characters of its postal code (a US ZIP3 or a Canadian FSA), which is enough to look up a shipping zone. Without those a finding cannot be proven. This is checked by an automated test on every build, not by a promise in this text.
Raw invoices are encrypted and live for 13 months
Source files and API responses sit in object storage encrypted with AES-GCM: a separate key per object, and that key is itself encrypted by a master key kept apart from the data. After 13 months the raw material is deleted. Findings stay while the account is open; they hold no personal data.
Access tokens
A 3PL token is encrypted the same way. The interface shows only the last four characters: neither our admin view nor our logs hold the full token. For ShipBob a read-only token is enough, and you can revoke it after the audit. We recommend exactly that.
You can skip tokens entirely
CSV upload is a first-class path, not a fallback: the same rules, the same report.
Passwords are hashed, and sign-in attempts are limited
Your password is stored only as a salted PBKDF2-SHA256 hash, never in plain text. After 10 wrong attempts in 15 minutes, password sign-in pauses for 15 minutes; the one-time email link still works. Changing your password signs you out on every other device.
Our own operator console is a separate host and does have a password, plus a one-time code from an authenticator app. Saying otherwise here would be a claim we cannot keep.
What we do not do
- We do not write to your 3PL account; billing access is read-only.
- We do not email your 3PL on your behalf. The dispute text goes to you, and you send it.
- We do not sell your data, do not share it with advertisers, and do not train models on it. There are no models in the audit core at all, only deterministic rules.
Deleting the account
Deletion removes every invoice, line, finding and raw file in one cascading operation. There is no please-wait-30-days.