Legal
Security
Last updated: 24 September 2026
Scan2Tray Ltd maintains a published Information Security Policy covering how we protect the account, order and marketplace data we process for live-commerce sellers on Whatnot, TikTok Shop and eBay Live. It is reviewed at least annually and after any material change.
Published documents
- Information Security Policy (v1.2)
- Access Control Policy
- Data Classification & Encryption Standard
- Personal Data Protection Policy
- Incident Response Policy
- Vulnerability & Threat Management Procedure
- Network Security & Segregation Overview
- Endpoint Security Standard
- Operational Security Baseline
All documents are PDF, in English.
Key controls
- All traffic to Scan2Tray services uses HTTPS with TLS 1.2 or higher; plain HTTP is not served.
- Passwords are stored only as salted BCrypt hashes; sign-in uses short-lived tokens with rotating refresh tokens, and login endpoints are rate-limited.
- Every request is scoped to the seller's own organisation; role-based access separates owners from packer sub-accounts.
- Marketplace OAuth tokens are held server-side only and are never sent to the browser, desktop or mobile apps. Sellers can disconnect a marketplace at any time.
- Inbound marketplace webhooks are signature-verified and de-duplicated before processing.
- Secrets are supplied as environment variables managed by the deployment platform and are never committed to source control.
- Production servers are reachable only over key-based SSH on a private network; the database is not exposed to the internet.
- Hosting is in EU data centres; the production database is backed up daily and backups are retained for at least 30 days.
- Security incidents follow a documented detect, contain, assess, notify and review process, including ICO notification within 72 hours where required by UK GDPR.
Legal entity
Scan2Tray Ltd is registered in England and Wales, company number 17096824. Registered office: Hilton Hall, Hilton Lane, Essington, Wolverhampton, WV11 2BQ, United Kingdom.
Security contact
To report a security concern or request the policy in another format, email hello@scan2tray.com.