Security

Report a security problem

If you think you have found a vulnerability in Ovnit, or data exposed that should not be, email security@ovnit.co. Please include:

• what you found, and the page or address where you found it;
• the steps to reproduce it;
• what an attacker could do with it, as you understand it.

Please do not put passwords, keys or other people’s personal data in the email. If you need to send something sensitive, say so in your first message and we will reply with a way to send it. While you look into a problem, please use only an account of your own, do not access or change other people’s data, and do not degrade the service for others.

We reply to confirm we have your report, tell you whether we can reproduce it, and let you know when it is fixed.

How we protect data

• Encrypted connections. Every page is served over HTTPS; plain HTTP is redirected, and browsers are told to use only HTTPS for ovnit.co and its subdomains.
• Passwords. Stored only as a slow, salted hash (scrypt), never in readable form. Passwords must be at least 8 characters.
• Sign-in protection. Repeated sign-in attempts from one network are limited. Changing a password signs out every other session. Two-step sign-in with an authenticator app is available to every user.
• Protection against forged requests. Every change made inside the app must carry a token that another website cannot obtain, and our pages tell browsers not to let other sites display them inside a frame.
• Separate accounts. Each brand’s data is kept to its own account. Inside an account, only the account holder can manage the team, billing and closing the account.
• A record of who looked. When someone in a brand’s account views or exports customers’ personal data, or a scheduled report emails it, we record who (or which schedule) did it and when, without copying the data into the record.
• Amazon connection. If a brand connects its Amazon seller account, the access Amazon grants is stored encrypted.
• Logs. Our main application server removes email addresses from the logs it writes.
• Where data lives. The database is stored with our hosting provider in London.
• Backups. Taken every day. Each new backup is restored into a scratch copy and checked against the data it was taken from before any older backup is deleted; the last 14 are kept.

What we do not claim

So that nobody relies on something we have not done: Ovnit is not certified to SOC 2 or ISO 27001, has not yet had an independent penetration test, is not monitored by staff around the clock, and does not promise a particular uptime. When any of that changes, this page will say so.

If something goes wrong

If a security incident affects personal data, we tell the brands whose data is affected without undue delay, and give them what they need to meet their own duties, including telling the Information Commissioner’s Office where the law requires it. Where we are responsible for the data ourselves, we notify the ICO within 72 hours when the law requires it.

More: the privacy policy, sub-processors, and the Privacy Centre.