How we protect partner data, customer data, and the warehouse.
We treat security the way we treat discretion — as a spec, not a feature. This page describes our current posture in plain language. If you have a security question that isn’t answered here, write to security@littlesfulfillment.com.
Encryption
All data is encrypted in transit using TLS 1.2+ and at rest using the cloud provider’s default AES-256. Database backups inherit the same encryption. We do not store payment-card data; our partners run their own checkout.
Access controls
Production access is restricted to named on-call engineers. All access is logged and reviewed quarterly. Warehouse staff have access only to the operations system (SKUSavvy) and only to the tenant they’re currently working with. No engineer touches customer addresses without an audit trail.
Network
Our application services run on Google Cloud Run with internal-only ingress for the worker tier and TLS-terminated ingress for the web tier. Cloud SQL and Memorystore are accessed over a private VPC connector — no public IP, no internet exposure.
Vulnerability management
We track our dependency tree against the GitHub Advisory Database. Critical CVEs are patched within seven days; high within thirty. Quarterly we run a focused review of our authentication and webhook-handling code paths.
Incident response
We commit to notifying affected partners within 72 hours of confirming a security incident. Incident commanders are named on-call engineers; communication is via the partner-known channel (email + portal banner). A post-mortem is shared with affected partners within 14 days.
Audit + compliance roadmap
We’re early. We’ve modelled our practice on SOC 2 Type 1 controls but have not yet completed an audit; we plan to schedule one once partner volume justifies the cost (typically ~$15K once a year). For partners who need formal attestation sooner, we can run a bilateral security review and sign a DPA today.
Responsible disclosure
If you believe you’ve found a vulnerability, please email security@littlesfulfillment.com with reproduction steps. We acknowledge within two business days. We don’t pay bounties yet, but we credit researchers publicly when they’d like and offer a hand-written thank-you that ships in a plain box.
Have a security question we didn’t cover?
We’ll write back the same week with a real answer, not corporate copy.