Security
MapProtector holds your catalogue, your policies, your evidence and the notices you send in your name. The controls below are how that data is kept separate, kept intact and kept under your control — and every one of them is enforced in code and checked by tests.
Every customer’s rows are separated by PostgreSQL row-level security, forced on every table that holds customer data — including for the table owner. A query with no tenant context returns nothing. The application does not filter by tenant; the database refuses to show it anything else, and an integration suite drives every cross-tenant path and expects a 404.
Passwords are hashed with Argon2id. A time-based one-time code (TOTP) is mandatory for every platform role and for every brand administrator, and required for any user who reads Amazon-sourced data. Sign-in is rate-limited per account and per address. Sessions have idle and absolute timeouts, and every session is ended when a password changes.
Nobody creates an account by typing an address into a form. Workspaces are created by MapProtector staff; administrators are invited by email with a single-use link, and they invite their teams. Roles are least-privilege: viewers cannot act, analysts cannot approve, and only brand administrators can arm enforcement.
An evidence package is a canonical manifest plus the assets it describes, each fingerprinted with SHA-256. Sealing fixes the fingerprint; every read verifies it; a mismatch is surfaced as a first-class status rather than served quietly. History is append-only — a sealed package is never edited, and a case never forgets an episode.
No notice reaches a seller without a person approving it and a verified sender identity to send it from. Seven blockers — missing contact, unsealed evidence, changed policy, cured case, data-quality hold, unverified sender, exhausted allowance — are checked at send time, not just at approval. Anything sent outside production carries a test marker in its subject.
MapProtector staff work in a separate console with a separate role model, and a staff grant is re-checked by the database on every statement. Support access to a customer workspace is an explicit, time-boxed, banner-visible session — never a silent login — and every action in it is attributed and audited.
Second-factor secrets are encrypted at rest with AES-256-GCM under a key the application holds separately from the database. Card details never touch MapProtector: checkout and payment methods are handled on the payment provider’s hosted pages, and the product never receives, stores or logs a card number.
Administrative actions — role changes, policy changes, enforcement approvals, support sessions, plan changes — are written to an audit log. The database schema changes only by versioned migration, and a verifier asserts the isolation, grant and integrity invariants on every build.
Straight answers
MapProtector does not currently hold a third-party certification, and this page does not imply one. Write-once object storage for evidence is a plan option that is provisioned per deployment, and the product records whether it is in force rather than assuming it. If you need a control we have not described, ask — we would rather say no than say yes and mean later.
Ask a security question