Security

VendorPrism implements a least-privilege, read-only application design. The public service is not a claim of organization-wide security certification.

Authentication and secrets

OAuth/LWA authorization uses a server-side, high-entropy, single-use state with a short TTL. Client secrets, refresh tokens, AWS signing credentials, and access tokens are supplied through approved private secret storage or environment, never committed, shared, logged, or returned to browsers. Access tokens remain in process memory and sanitized diagnostics expose statuses only.

Seller authorization credentials and tokens are not research data. They may exist only while the seller connection is authorized, remain in approved private secret storage, and are revoked/deleted when the connection is terminated or security requires it.

Transport and resilience

Provider requests use HTTPS and AWS Signature Version 4. Retry behavior is bounded. Missing authorization, incomplete provenance, and missing economic fields fail closed.

Incident response

Security incidents are handled with containment, evidence preservation, recovery, and applicable notification procedures.

Security contact

Report security and privacy matters to vendorprism.support@gmail.com. Support is asynchronous with no guaranteed support hours. Do not include credentials, authorization codes, tokens, or secret keys in reports.

VendorPrism is operated by Mehmet Birkan Bilgiç. The public presentation contains only the truthful organization name and no owner home address, phone number, personal email, government/tax ID, or other PII.