Security

1. Infrastructure

SimplyUpsell runs on Cloudflare: a Worker serves the website and the API, and a Cloudflare D1 database stores accounts, stores, offers and offer counts. We rely on Cloudflare for network protection and availability.

2. Encryption

• All traffic between your browser and SimplyUpsell uses HTTPS. On our own domain, plain HTTP is redirected to HTTPS.
• Data stored with Cloudflare is encrypted at rest by the provider.

3. Passwords and sessions

• Passwords are hashed with PBKDF2 and a unique salt. We cannot read them.
• Sessions use a random token. Only a hash of the token is stored on our side.
• The session cookie (simplyupsell_session) is HttpOnly, Secure and SameSite=Lax, and lasts 30 days.
• Sign-in and contact requests are rate limited. Requests that change data must come from our own site.

4. Access control

Every store and offer belongs to one account and cannot be read or changed by another. Back office access is limited to named staff accounts.

5. Payments

Payments are taken on a hosted page by Airwallex. Card numbers never touch our servers. We keep only the plan, amount, date and a payment reference.

6. The embed script

The script is plain JavaScript served from our domain. It draws offers inside an isolated shadow DOM so that it cannot change your page styles, sets no cookies and sends only the offer, variant, event type and day. Links in offers open in a new tab with no opener access.

7. Data location and deletion

Your data is held on Cloudflare's global network. You can delete your account in the account page. This deletes your account, stores, offers and counts. See the Privacy Policy for what we keep for accounting.

8. Backups and incidents

We rely on the durability features of Cloudflare D1. If we find an incident that affects personal data we will investigate quickly, fix it, and tell affected users and the regulator where the law requires.

9. Reporting a vulnerability

If you think you have found a security problem, please email support@simplyupsell.com with the details. Do not access other people's data and give us reasonable time to fix the issue before sharing it. We will acknowledge your report within 3 business days.

10. Providers