Vantwyn
Security
How to tell us about a security or privacy problem in Vantwyn, and what we do when you do.
To report a problem
Email n@vantwyn.com
Put “Security” in the subject. Tell us what you found, where it is, how to make it happen again, and what somebody could do with it.
The same address takes privacy concerns and any suspected misuse of Amazon data, whether in Vantwyn itself or by somebody using it. Please do not send us anybody else’s data.
What happens next
- Within two business days we reply to say we have it, with a reference number we use in every message about it.
- We look into it and tell you what we found and what we are going to do.
- We fix serious problems quickly: critical ones within 7 days, high-risk ones within 30 days.
- We tell you when it is fixed, and we will credit you by name if you would like that.
- If Amazon data may have been exposed, we tell Amazon within 24 hours, as its developer rules require. We tell the sellers affected as well, in a notice Amazon’s rules let it review first, unless the law says they must hear sooner.
Testing in good faith
We welcome reports from security researchers. If you act in good faith and within these rules, we will not take legal action against you for your research:
- Test only accounts you own or have permission to use. Never read, change or delete somebody else’s data. If you reach some by accident, stop there and tell us what you saw.
- No denial-of-service testing, no spam, and no social engineering of us or of our users.
- Give us a fair chance to fix a problem before you tell anybody else: 90 days, unless we agree otherwise.
This covers app.vantwyn.com and www.vantwyn.com. The services we build on — Clerk for sign-in, Amazon Web Services for hosting, Anthropic for the written summary — run their own programmes; report their problems to them.
How we look after security
- Every connection to Vantwyn is encrypted, and old versions of the encryption are refused.
- Only the web pages are open to the internet. The application and its database sit behind the web server and cannot be reached directly, and the server’s own remote login answers only the owner’s address.
- Passwords are held by Clerk, never by us, and one person can only ever see the accounts they are entitled to — a guarantee our automated tests check.
- Nothing is ever changed in a seller’s Amazon account. The Amazon connection is read-only.
- We keep a written incident response plan and review it every six months.
More detail on what we keep and why is in our privacy policy. Tools can find this page through /.well-known/security.txt.
This service is run by Vantwyn LLC. Sellers’ data is theirs: it is used only to do the job and to improve the product for them, and it is never sold or shared with other companies.