Skip to content
Palermo
Log inJoin now

Draft. Highlighted items are placeholders and must be filled in before this page is published for review.

Trust

Security at Palermo

Sellers trust Palermo with their Seller Central authorization and their inbox. Here’s how we protect them.

Last updated September 14, 2026

Every workspace is walled off at the database

Every record in Palermo belongs to exactly one workspace. Access is enforced by Postgres row-level security, not only by application code: a query made on behalf of a signed-in person can only return rows from the workspaces they belong to. Automated tests try to read and write across workspaces, and every change must pass them.

Inside a workspace, roles limit what people can do. Owners and admins manage connections and invites. Members, such as a VA, can view reports and fill in SKU costs but can’t connect or remove accounts.

Encryption

  • In transit. All connections to Palermo, and from Palermo to Amazon, Google, our database and our AI provider, use TLS 1.2 or later. HTTP redirects to HTTPS and browsers are told to use HTTPS only (HSTS).
  • At rest. The database and file storage are encrypted at rest by our infrastructure provider.
  • Credentials, with a key per workspace. Amazon and Google refresh tokens and prep center API keys are also encrypted by Palermo with AES-256-GCM, using a data key unique to each workspace. Each encrypted value is bound to its workspace and connection, so it can’t be decrypted anywhere else. The keys that protect the workspace keys are held outside the database. Signed-in users, including workspace owners, can’t read stored credentials; only Palermo’s sync services can use them.

We ask for as little as the product needs

  • Amazon. Palermo requests four Selling Partner API roles: Inventory and Order Tracking, Amazon Fulfillment, Finance and Accounting, and Product Listing. It doesn’t request restricted roles and doesn’t receive buyer names, addresses or tax information.
  • Gmail. Read-only access. Palermo can’t send, delete or change email. It stores the facts from retailer order emails and the order confirmation PDF, never the rest of your mailbox. See how we use Google user data.
  • AI. Only matched retailer order emails and the sheet contents needed to map an import are sent to our AI provider. Amazon data is never sent.

Who can reach production

  • Production access is limited to the few people who operate Palermo, each with a named account. There are no shared logins.
  • Multi-factor authentication is required on every account that can reach production systems or customer data, including our cloud, database, hosting, code and email providers.
  • Access is reviewed every quarter and removed within 24 hours when someone’s role changes.
  • No one at Palermo reads a customer’s emails unless the customer asks us to, it’s needed to investigate security or abuse, or it’s required by law.

Logging and vulnerability management

  • Sign-ins, account connections and disconnections, credential use, admin actions and errors are logged. Logs exclude email contents and credentials, and are kept for 12 months.
  • Secrets are never stored in code. Dependencies and code are scanned for known vulnerabilities, and the running app is scanned at least monthly.
  • Critical vulnerabilities are fixed within 7 days and high-severity ones within 30 days.
  • Before Gmail access opens to all users, Palermo completes Google’s independent security assessment (CASA).

Incident response

We keep a written incident response plan and review it every six months. If an incident affects your data, we contain it (revoking affected tokens and rotating keys), tell you without undue delay and within 72 hours of confirming it, and explain what happened and what we changed. Incidents involving Amazon data are reported to Amazon within 24 hours, as its policy requires.

Retention and deletion

Disconnecting a source deletes its stored credentials immediately. Deleting a workspace deletes its data within 30 days. Revoking Palermo in Seller Central deletes its Amazon data within 30 days. The privacy policy has the full schedule.

Infrastructure providers

  • Supabase: Postgres database, authentication, file storage.
  • Vercel: web hosting.
  • DigitalOcean: background sync and processing.
  • Anthropic: AI reading of matched order emails.

For Google Workspace administrators

If your organization restricts third-party apps, a Workspace admin can allow Palermo so your team can connect Gmail:

  1. In the Google Admin console, go to Security → Access and data control → API controls.
  2. Open Manage Third-Party App Access and add an app by OAuth client ID.
  3. Enter Palermo’s client ID: [GMAIL OAUTH CLIENT ID]
  4. Choose the organizational units, and set access to Trusted.

Questions? Email support@trypalermo.com.

Report a vulnerability

Email security@trypalermo.com with the details and steps to reproduce. We’ll acknowledge within two business days and keep you updated. Please don’t access other customers’ data, degrade the service, or disclose the issue publicly before we’ve fixed it. We won’t pursue good-faith research that follows these guidelines.