Security

Last updated: 2026

Protecting customer data is a top priority at OKTee. This page describes the technical and organizational measures implemented to protect the confidentiality, integrity and availability of the data processed on our platform.

OKTee processes only the data required to provide its services, including OKTee Ops, OKTee Marketing, OKTee Logistics and future Finance modules.

1. Infrastructure and hosting

OKTee is built on a cloud infrastructure designed to host core customer data in Europe where the configuration allows it, while relying on certain technical providers that may involve controlled transfers outside the European Union.

• Public website, legal pages and public content: hosted through Framer. The oktee.io website is used to present OKTee services, publish legal pages and provide information to customers, prospects and partners. The public website does not store customers’ operational Amazon data.
• Application interface: hosted through Vercel when this infrastructure is used for the OKTee application. The interface is mainly used to display the application to authorized users. Background processing and primary storage of customer data are not performed in Vercel. Any transfers outside the European Union are covered by appropriate contractual safeguards.
• Customer database: Neon, managed PostgreSQL, hosted in the European Union where the configuration allows it. Customer data, user data, catalog data, order data and Amazon data required for the operation of the platform are stored in this database.
• Automated processing: Railway, used to run synchronization workers, automated processing and server-side tasks. The workers read, process and transmit the data required for the modules enabled by the customer.
• Orchestration: Inngest, used to trigger and supervise certain asynchronous tasks, processing queues, scheduled runs and application workflows.
• Application monitoring: Sentry, used to detect application errors, diagnose incidents and improve service stability. OKTee applies sensitive data filtering where possible.
• AI-assisted analysis: OpenAI may be used for certain OKTee Marketing features, only when these features are enabled by the customer and only for data strictly necessary for product analysis.
• Product page monitoring: Rainforest API may be used to collect certain public Amazon product page signals required for OKTee Marketing, such as visible content, prices, availability or offer signals, when such data is not available or not sufficient through official Amazon APIs.

The technical providers used by OKTee are covered by contractual terms, DPAs or transfer safeguards where required.

2. Data encryption

3. Access control

• Role-based access control, RBAC: access to data and features is limited according to each user’s role.
• Least privilege principle: each user only accesses the information required for their responsibilities.
• Multi-tenant isolation: each customer’s data is logically isolated. Cross-customer access is not authorized.
• Internal access: OKTee team members access a customer’s data only when necessary to provide, maintain, secure or support the service.
• Traceability: important actions may be logged to enable technical, operational or security monitoring.
• Secure sessions: user sessions are protected by appropriate authentication and expiration mechanisms.

4. Amazon SP-API connection security

OKTee connects to Amazon Vendor Central accounts authorized by its customers through the official Amazon APIs, SP-API. For certain OKTee Marketing features, OKTee may also collect public Amazon product page signals through specialized technical providers, when such data is not available or not sufficient through official Amazon APIs.

• The connection to Amazon Vendor Central accounts is initiated by the customer through the official Amazon authorization flow. OKTee never directly asks customers for their Amazon credentials.
• Amazon access tokens are stored securely and are not exposed to end users.
• OKTee access can be revoked by the customer from its Amazon interface where this option is available.
• Requested permissions are limited to the roles required for the modules enabled by the customer.
• OKTee does not sell Amazon data, does not share it for advertising purposes and does not use it outside the services authorized by the customer.

5. Amazon data processed

Depending on the modules enabled and the permissions granted by the customer, OKTee may process certain data from Amazon Vendor Central.

• order data;
• order statuses;
• order acknowledgements and order responses;
• shipment data;
• inventory and availability data;
• catalog data;
• pricing and offer data;
• Brand Analytics data, when available and authorized;
• financial data, invoices, payments, deductions, discrepancies, shortages or chargebacks, when the corresponding access rights are granted.

6. Data from customer systems

OKTee may also process complementary data from customer-authorized systems.

To date, this mainly concerns the customer’s product catalog, retrieved from the customer ERP through the OKTee API or through the customer’s API. This catalog is used to match Amazon purchase orders with the customer’s internal product references, stock rules, logistics rules and automation settings used in OKTee Command Center.

For future Finance modules, OKTee may process other customer-owned data, including ERP, accounting, invoicing, payment, deduction or financial reconciliation data, only when the relevant module is enabled and authorized by the customer.

7. Network security

• HTTPS: all communications between the user and the application are protected via HTTPS.
• Application protection: the infrastructures used by OKTee include protections against common attacks, including injections, unauthorized access attempts or traffic abuse.
• Security headers: security headers may be applied to reduce browser-related risks.
• Environment separation: production, staging and development environments are separated.
• Secrets management: identifiers, API keys and credentials are not stored in code repositories.

8. Security incident management

OKTee has an incident response procedure covering detection, analysis, remediation and communication to affected customers where necessary.

• Detection and qualification of the incident;
• Assessment of potential impact;
• Containment and corrective measures;
• Information to affected customers when the incident affects their data;
• Reasonable assistance to the customer in meeting its regulatory obligations;
• Post-incident analysis and improvement of security measures.

In case of suspected data breach involving your Amazon or OKTee information, you can contact us immediately at: privacy@oktee.io

9. Secure development practices

• Change review: important application changes are reviewed before being deployed to production.
• Dependency management: OKTee monitors known vulnerabilities in the dependencies used by its application.
• Secrets and credentials: no identifier, API key or password should be stored in code repositories.
• Vulnerability remediation: critical vulnerabilities are handled as a priority.
• Application monitoring: technical errors are monitored to detect malfunctions quickly.

10. Authentication and passwords

• User accounts are protected by secure authentication mechanisms.
• Passwords are never stored in plain text.
• Internal OKTee access is limited to authorized personnel.
• Credential sharing between team members is prohibited.
• Additional authentication strengthening measures may be enabled depending on customer or organizational needs.

11. Sub-processors and data transfers

OKTee ensures that its technical sub-processors are used for specific purposes: public website hosting, application hosting, database management, synchronization workers, orchestration, application monitoring, AI-assisted analysis or public product page monitoring.

Certain sub-processors may involve transfers outside the European Union. Where necessary, such transfers are covered by appropriate contractual safeguards, including the European Commission Standard Contractual Clauses.

Main technical sub-processors

The full list of sub-processors is available on the Sub-processors page.

12. Compliance

13. Vulnerability reporting

If you discover a security vulnerability in our systems, please report it responsibly to: privacy@oktee.io

OKTee commits to reviewing any report diligently and prioritizing critical vulnerabilities.

14. Security contact

See also: Privacy Policy · Sub-processors · DPA · Amazon Integration