Security
Built as a system of record, and protected like one.
MapProtector holds your catalog, your policies, your evidence and the notices you send in your name. This page describes how that data is kept separate, kept intact and kept under your control — as implemented today, in the terms a security review needs. If your review needs something we have not described, ask; we would rather say no than say yes and mean later.
Questions and reports: support@mapprotector.com
Hosting
Hosted on secure cloud infrastructure, changed only through review.
MapProtector runs on secure, managed cloud infrastructure. The service is operated through the application and managed tooling, and every infrastructure and application change is reviewed before it is applied.
Reachability
Customer data is reachable only through the application, over HTTPS. The database and evidence storage are not exposed to the public internet.
Monitoring and change control
Account activity is logged and monitored, with findings routed to a mailbox that is read. Changes reach production only through a reviewed, automated path.
In transit and at rest
Encrypted on the wire, encrypted on disk, and credentials never in plaintext.
Transport encryption is the floor. The data whose compromise would be a different kind of incident — credentials and second factors — is protected again inside the application.
In transit
Modern TLS at the edge with HTTP Strict Transport Security. Connections inside the service are encrypted as well.
At rest
The database, evidence storage and application secrets are encrypted at rest under managed keys.
Credentials
Passwords are stored only as strong one-way hashes. Authenticator secrets, session tokens and recovery codes are never stored in plaintext.
- A database copy alone yields no usable password, session, recovery code or second factor
- Changing a password ends every other session on the account
Tenant isolation
Each customer’s data is kept separate.
Every customer’s catalog, policies, sellers, findings, evidence and notices are isolated from every other customer’s, and that isolation is checked by automated tests on every build.
Workspace isolation
A request can only ever see the workspace it belongs to. Cross-workspace access is exercised by an automated suite that expects every attempt to be refused.
Platform staff, separated
MapProtector staff work in a separate console with its own roles. Customer compliance data — findings, cases, evidence, notices — is not visible to it; operators see service health, never your rows.
Support access
Support access to a customer workspace is an explicit, time-boxed, read-only session that is visible on screen while it is active. A support session cannot confirm a finding, seal evidence, classify a seller, approve a notice or change a policy, and every action in it is attributed and audited.
No pooled data
There is no cross-customer seller reputation and no shared score. One brand’s dismissals are not another brand’s evidence.
Accounts and access
Invitations, second factors, and a fresh factor before anything that reaches a seller.
Nobody creates an account by typing an address into a form. Workspaces are created by MapProtector for a customer; the first administrator is invited by email and invites the rest. Roles are least-privilege, and the acts whose consequences reach a third party need a second factor presented recently.
Second factors
A time-based one-time code from an authenticator app — no SMS, no email code — is mandatory for every Brand Admin, every platform role, and any member who reads marketplace-sourced data. Single-use recovery codes are shown once and never stored in plaintext.
Step-up for consequential actions
Approving a notice, sending it, configuring the sender identity, publishing a template or sequence, sealing evidence and enabling Amazon connectivity each require a fresh second factor and an explicit confirmation.
Sessions and sign-in
Sessions expire. Sign-in and second-factor attempts are rate-limited, a rejected credential never reveals which part was wrong, and password-reset and invitation links are single-use and short-lived.
Roles
Viewers and Legal Reviewers read; Analysts work the catalog and the queues but sign no decision; Compliance Managers confirm, classify and prepare; Brand Admins seal, approve, send, invite and bill.
Audit
Who did what, when, in a record that cannot be edited.
Administrative and compliance actions are written to an audit history the application can add to and cannot change. Content and SEO changes on the public site are recorded the same way.
What is recorded
Role and membership changes, policy changes, promotion approvals, exceptions, review decisions, evidence requests, seals, integrity checks, notice approvals and sends, holds, sender changes, support sessions and plan changes — each with the actor, the instant and the relevant identifiers.
Frozen records
Published template and sequence versions, approved notices, approvals and delivery outcomes cannot be changed once written. Closed breaches, sealed evidence and observations are never updated; a correction is a new record that references the old one.
Controlled integrations
Marketplace access you grant and can withdraw; payment details we never see.
MapProtector connects to your marketplace and to a payment provider. Each connection is scoped to what the product needs and nothing more.
Amazon connectivity
When Amazon connectivity is enabled for your workspace, MapProtector monitors marketplace pricing using authorized data access your organization grants and can withdraw at any time. MapProtector never asks for your Amazon password, and the credential that authorization produces is handled as a secret: never shown on any screen, never written to logs or exports.
What the authorization reads
Listing offers and the seller information associated with them, in the marketplaces you approved. Not orders, not customers, not inventory, not financial data.
Application secrets
Credentials the service itself depends on are held in a managed secrets store and are never committed to source.
Card data
Checkout and payment methods are handled on the payment provider’s hosted pages. MapProtector never receives, stores or logs a card number.
Evidence integrity
A sealed record proves it has not changed.
Evidence exists to be put in front of somebody who does not trust you. Its integrity is therefore a security property, not a feature.
Sealing
Sealing fixes an evidence record and every attached file with a cryptographic fingerprint, the instant and the person who sealed. The fingerprint is shown beside every download so a recipient can verify it independently.
Verification that repairs nothing
Every time a sealed record is opened, its integrity is checked again and any mismatch is reported rather than corrected. Each check is recorded with its outcome.
Storage
Evidence is kept in private storage, served only through a signed-in session, and protected against accidental overwrite or deletion.
Uploaded files
Files a user attaches are validated and fingerprinted on arrival. Until malware scanning is in force they are held as unscanned, and can be retrieved only after an explicit acknowledgement that says why.
Backups and recovery
Backed up, and tested to come back.
Losing a day of observations is an outage; losing sealed evidence is an incident. Both are planned against.
Production data
Production data is protected by automated backups and tested recovery procedures.
Evidence
Evidence storage is protected against accidental overwrite or deletion, and a failed evidence capture is reported rather than silently dropped.
Changes to the data model
Changes to how data is stored are versioned, reviewed and rehearsed before they reach production.
Delivery
Notices leave from your verified sender, and only after the required checks.
Outbound mail is the one place the product acts outside its own boundary, so it is the most guarded path in it.
Seller notices
A notice leaves only from a sender identity your Brand Admin configured and verified — never from a MapProtector address — and only after the required approvals and readiness checks pass.
Delivery outcomes
Sent, delivered and failed are shown separately, from what the mail provider reports back. A send whose outcome is unknown is shown as unknown rather than guessed at, and MapProtector does not send a second copy on its own.
Notifications to people
Operational alerts and seller enforcement are separate, so a notification preference can never switch on a notice to a third party. Security messages — password changed, second factor changed, access removed — cannot be turned off.
Reporting
Found something? Tell us.
If you believe you have found a security issue in MapProtector, write to support@mapprotector.com with what you found and how to reproduce it. We read every report, we will acknowledge it, and we will tell you what we did about it. Please do not access, change or retain data that is not yours while demonstrating an issue.
There is no bug-bounty program and no published response-time commitment; this page does not claim either.
Straight answers
What we do not claim.
No third-party certification
MapProtector does not currently hold an independent security certification or attestation, and this page does not imply one. If your procurement requires a specific control we have not described, ask and we will answer specifically.
No malware scanning of uploads yet
Uploaded evidence files are validated and fingerprinted but not scanned for malware. The product treats them as unscanned rather than pretending otherwise: retrieval is limited to members of your organization who hold the permission to export evidence, requires an explicit acknowledgement, and is recorded. The acknowledgement does not make the file safe. Malware scanning of uploads is a hardening item ahead of broad customer use of the upload.
No write-once retention by default
Evidence storage is private and protected against accidental loss, but write-once retention is not guaranteed by default. Where it is provisioned for a deployment, the product records that it is in force rather than assuming it.
No screenshots of Amazon
Evidence is derived from MapProtector’s own records of what the marketplace reported through the access your organization authorized, and is labeled as exactly that. MapProtector does not capture the listing page itself.