Pricelyzer
Sign inSign up

LEGAL

Security

Last updated: June 2, 2026

1. Overview

Pricelyzer is a cross-store product comparison platform with paid sourcing tools for Amazon sellers, operated by Lookfar Analytics Inc., a British Columbia corporation headquartered in Port Coquitlam, BC, Canada. Our security controls protect the data we handle: Amazon authorization credentials, account identifiers, and billing relationships. This page describes the controls we have in place. To report a vulnerability or security concern, email privacy@pricelyzer.com.

2. Encryption in transit

All traffic to pricelyzer.com and our API backends is served over HTTPS using TLS 1.2 or higher with modern cipher suites. TLS is terminated at the Cloudflare edge for the public domain and at the Supabase-managed database layer for database connections. HSTS is enabled on the public domain.

3. Encryption at rest

Application data is stored in Supabase managed Postgres with AES-256 encryption at the storage layer. Amazon access and refresh tokens are held in a dedicated, encrypted database column and kept out of application logs.

4. Amazon credential security

Pricelyzer accesses your Amazon Seller Central account on a read-only basis, limited to the Pro tools you enable. Tokens are stored in our managed Postgres database with encryption at rest. You can revoke Pricelyzer's access at any time from Seller Central, and we delete the associated data within 30 days of the end of your grace period. Pricelyzer is not affiliated with, endorsed by, or sponsored by Amazon.com, Inc.

5. Access controls

  • Least privilege. Production database access is limited to the application service identities and a small set of named Pricelyzer engineers operating under audited break-glass procedures.
  • MFA. Multi-factor authentication is enforced on all privileged tooling (cloud provider, database, payments, domain).
  • Audit logs. We rely on the native audit trails provided by our hosting and database providers to detect and investigate access.
  • Secrets.Production secrets are held in the hosting provider's encrypted environment-variable store and rotated when a team member's access is revoked.

6. Infrastructure

  • Compute: Hetzner Cloud in Hillsboro, Oregon, USA (Hetzner is ISO 27001 certified).
  • Database and auth: Supabase in Toronto, Canada (SOC 2 Type II certified).
  • Edge, DNS, WAF, DDoS mitigation: Cloudflare.
  • Next.js hosting: Vercel (Portland, Oregon).

7. Application security

  • Parameterised queries; no string-concatenated SQL.
  • Output encoding via React's default escaping.
  • Per-IP rate limiting on public API surfaces.
  • HTTP-only, Secure, SameSite session cookies issued by Supabase Auth.
  • Code review against the OWASP Top 10 and OWASP Top 10 for LLMs.

8. Security monitoring

Sentry is deployed in production for application error and performance monitoring, with personal data filtered out of error payloads. Hosting and database providers expose native audit trails. We follow a documented incident-response runbook with a target of GDPR Art. 33 72-hour breach notification to affected users and relevant supervisory authorities where required.

9. Compliance posture

Pricelyzer is built on infrastructure providers that hold the industry's leading security certifications, and we inherit their controls across the stack:

  • Supabase— database and authentication, SOC 2 Type II certified.
  • Hetzner— compute, ISO 27001 certified.
  • Stripe— payments, PCI-DSS Level 1 certified.
  • Cloudflare— edge, DNS, and DDoS mitigation.

We expand our own formal compliance program as customer scale warrants.

10. Business continuity

We use Supabase Pro tier automated daily backups with point-in-time recovery. Our target Recovery Time Objective (RTO) for core services is under 4 hours; our Recovery Point Objective (RPO) is under 24 hours. Application code is held in git with multiple mirrors.

11. Responsible disclosure

If you discover a vulnerability, email privacy@pricelyzer.com with details and reproduction steps. We acknowledge reports within 48 hours. With your consent we will credit you publicly once a fix is deployed. Please give us a reasonable disclosure window before publishing.

12. Contact

Security reports, abuse, and breach concerns: privacy@pricelyzer.com