1. 凭证保管1. Credential handling
- 平台 API 凭证（client id/secret、refresh token）只保存在密钥管理中：云端用 Cloudflare Worker secrets，本地执行器用受操作系统权限保护的环境文件。Marketplace API credentials (client IDs/secrets, refresh tokens) are held only in secret storage: Cloudflare Worker secrets in the cloud, and OS-permission-protected environment files on the local executor.
- 凭证不写入业务数据库、不写入日志、不进代码仓；代码仓有硬性规则禁止提交任何密钥。Credentials are never written to the business database, to logs, or to source control; the repository has a hard rule against committing secrets.
- 访问令牌按平台规定的有效期短周期轮换，过期即刷新，不做长期缓存。Access tokens are short-lived and refreshed on the schedule the marketplace defines; they are not cached long-term.
- 凭证按店铺隔离（每店独立命名空间），一家店的凭证不能用于另一家店。Credentials are isolated per store (namespaced by store), so one store's credentials cannot be used for another.
2. 加密2. Encryption
- 全部网络传输强制 HTTPS/TLS，包括控制台、API 与所有平台调用。All network traffic is HTTPS/TLS — the console, our API, and every marketplace call.
- 静态数据由 Cloudflare 托管服务加密（D1 数据库、对象存储、KV、Worker secrets）。Data at rest is encrypted by Cloudflare's managed services (D1 database, object storage, KV, Worker secrets).
- 用户口令只存 PBKDF2 加盐散列，系统内不存在可读口令。User passwords are stored only as salted PBKDF2 hashes; no readable password exists in the system.
- 密码重置令牌只存 SHA-256 摘要，30 分钟过期、一次性使用。Password reset tokens are stored only as SHA-256 digests, expire in 30 minutes, and are single-use.
3. 访问控制3. Access control
- 控制台不对公网开放：未登录的请求连前端资源都拿不到，只会看到登录页。The console is not publicly reachable: unauthenticated requests cannot even retrieve the front-end bundle — they receive the sign-in page.
- 每人独立账号，无共享账号；新账号需管理员审批后才生效。Every person has an individual account; there are no shared logins, and new accounts require administrator approval before they work.
- 按角色区分权限，运营人员只能访问被指派的卖家与店铺（最小必要）。Permissions are role-based; operators can access only the sellers and stores assigned to them (least privilege).
- 登录接口对邮箱与来源 IP 双维度限速，防暴力破解；会话使用签名 cookie，14 天过期。The sign-in endpoint is rate-limited per email and per source IP to resist brute force; sessions use signed cookies that expire after 14 days.
4. 买家个人信息（PII）最小化4. Minimizing buyer PII
- 只在履约确有需要时才取用买家 PII，并按平台机制（如 Amazon 的受限数据令牌 RDT）逐次授权获取。Buyer PII is retrieved only when fulfillment genuinely requires it, and through the marketplace's own mechanism for it (such as Amazon's Restricted Data Tokens).
- PII 不进日志、不进分析、不进 AI 提示词。PII never enters logs, analytics, or AI prompts.
- PII 保留期不超过履约所需，最长 30 天，之后删除或匿名化。PII is retained no longer than fulfillment requires, capped at 30 days, then deleted or anonymized.
- 不导出到本地表格、不落到个人设备。It is not exported to spreadsheets or stored on personal devices.
5. 操作可审计5. Auditability of actions
系统里所有写操作——改价、上下架、发货、回复评价——都不是直接改库，而是先落成一条任务记录（谁发起、什么参数、什么时间、执行结果、失败原因），由执行器领取执行并回写日志。因此每一次对平台的写入都能追溯到具体的人与时间。Every write action in the system — repricing, activating or deactivating listings, shipping, replying to reviews — is not a direct database edit. It is recorded first as a task (who initiated it, with what parameters, when, the result, and any error), then claimed and executed by the executor, which writes logs back. Every write to a marketplace is therefore traceable to a specific person and time.
6. 基础设施6. Infrastructure
| 组成Component | 说明Description |
|---|---|
| 运行环境Runtime | Cloudflare Workers（无长期运行的服务器、无对外开放的 SSH/端口）Cloudflare Workers — no long-lived servers, no exposed SSH or ports |
| 数据库Database | Cloudflare D1（托管、加密、按天备份）Cloudflare D1 — managed, encrypted, backed up daily |
| 执行器Executor | 仅出站连接的本地进程，不监听任何入站端口A local process that makes outbound connections only; it listens on no inbound port |
| 代码Code | 私有仓库，变更走提交记录，可回溯Private repositories; every change is tracked in commit history |
7. 事件响应7. Incident response
- 发现疑似泄露或异常访问，先立即吊销相关凭证并切断该店铺的自动化执行。On suspected exposure or anomalous access, we immediately revoke the affected credentials and halt automation for that store.
- 确认事件后 24 小时内通知受影响卖家与相应平台（符合 Amazon 数据保护政策的 24 小时通报要求）。Within 24 hours of confirming an incident we notify affected sellers and the relevant marketplace, meeting the 24-hour notification requirement in Amazon's Data Protection Policy.
- 事后复盘并落成修复项，记录在案。We run a post-incident review and record the resulting fixes.
- 安全问题报告：security@sailerpartners.comReport security issues to security@sailerpartners.com
8. 合规对齐8. Policy alignment
我们按各平台的开发者条款运作，包括 Amazon 的《可接受使用政策》（AUP）与《数据保护政策》（DPP）：数据仅用于卖家授权的业务用途、不转售、不与无关方共享、按最短周期保留、事件 24 小时通报。数据处理详情见 隐私政策。We operate under each marketplace's developer terms, including Amazon's Acceptable Use Policy (AUP) and Data Protection Policy (DPP): data is used only for the business purposes the seller authorized, never resold, never shared with unrelated parties, retained for the shortest period necessary, and incidents are reported within 24 hours. See our Privacy Policy for how data is processed.