Security Policy

Last updated: 2026

Protecting customer data is a top priority at OKTee. This page outlines the technical and organizational measures implemented to safeguard the confidentiality, integrity, and availability of data processed on our platform.

OKTee only processes the data required to deliver its services, specifically OKTee Ops, OKTee Marketing, OKTee Logistique, and future Finance modules.

1. Infrastructure & Hosting

OKTee is built on cloud infrastructure designed to host core customer data in Europe whenever configuration permits, while utilizing select technical sub-processors whose services may involve compliant data transfers outside the EU.

• Marketing Website, Legal Pages & Public Content: Hosted on Framer. The oktee.io site is used to showcase OKTee services, publish legal agreements, and share informational content with customers, prospects, and partners. The marketing website does not store any operational Amazon data from customers.
• Application Interface: Hosted on Vercel when this infrastructure is deployed for the OKTee application. The interface primarily serves to render the application for authorized users. Core backend processing and primary customer data storage are not handled on Vercel. Any transfers outside the European Union are governed by appropriate contractual safeguards.
• Customer Database: Neon, a managed PostgreSQL service, hosted in the European Union where configuration permits. This database stores customer records, user accounts, catalog details, order histories, and the Amazon data required to run the platform.
• Background & Automated Processing: Railway is used to run sync workers, background processes, and server-side automated tasks. These workers read, process, and route data required for the customer's active modules.
• Workflow Orchestration: Inngest is used to trigger and monitor asynchronous tasks, processing queues, scheduled runs, and application workflows.
• Application Performance Monitoring: Sentry is used to detect application errors, diagnose performance anomalies, and improve overall service reliability. OKTee applies strict data scrubbers to filter out sensitive details where applicable.
• AI-Assisted Analysis: OpenAI may be leveraged for specific features in OKTee Marketing. This only occurs when these features are explicitly enabled by the customer, and only for data strictly relevant to product performance analysis.
• Product Page Monitoring: Rainforest API may be utilized to capture public signals from Amazon product detail pages (PDPs) required for OKTee Marketing—such as live content, buybox pricing, availability, or offer signals—when this data is unavailable or incomplete via official Amazon APIs.

Technical partners utilized by OKTee are governed by standard contractual terms, DPAs, or transfer mechanisms where required.

2. Data Encryption

3. Access Control

• Role-Based Access Control (RBAC): Access to data and features is strictly restricted based on assigned user roles.
• Principle of Least Privilege: Users are granted only the access permissions required to perform their specific business functions.
• Multi-Tenant Isolation: Customer data is logically segregated. Cross-tenant access is strictly blocked.
• Internal Access: OKTee team members only access customer data when explicitly required for system maintenance, security operations, or customer support request resolution.
• Audit Trails: Key system events and actions are logged for technical, operational, and security review.
• Secure Sessions: User sessions are protected by industry-standard authentication flow controls and automated timeouts.

4. Amazon Connection & SP-API Security

OKTee integrates with authorized Amazon Vendor Central accounts via the official Amazon Selling Partner API (SP-API). For specific OKTee Marketing features, OKTee may also crawl public signals from Amazon PDPs using specialized data partners when these details are not available via official Amazon APIs.

• Connections to Amazon Vendor Central are initiated by the customer using Amazon’s official OAuth authorization flow. OKTee never requests, stores, or handles your raw Amazon login credentials.
• Amazon access tokens are stored securely and are never exposed to end-users.
• OKTee API access can be revoked by the customer at any time directly from their Amazon Seller Central/Vendor Central partner console.
• Requested permissions are strictly limited to the specific API roles needed to run active OKTee modules.
• OKTee does not resell Amazon data, share it for advertising purposes, or utilize it outside of delivering authorized customer services.

5. Processed Amazon Data

Depending on the active modules and the access permissions granted, OKTee processes specific operational data from Amazon Vendor Central:

• Order data
• Purchase order statuses
• Order acknowledgements and confirmations
• Shipping and routing details
• Inventory levels and availability
• Catalog attributes
• Pricing and buybox offer signals
• Brand Analytics data (where available and authorized)
• Financial data, including invoices, payments, deductions, shortages, or chargebacks (where relevant roles are enabled)

6. External Data Systems

OKTee may also process auxiliary data imported from authorized customer systems.

Currently, this primarily includes the customer's master product catalog, ingested from their ERP via the OKTee API or the customer's native API. This catalog enables the mapping of Amazon purchase orders to internal SKUs, inventory allocation rules, fulfillment logic, and automated workflows within OKTee Command Center.

For future Finance modules, OKTee may ingest other billing details held by the customer— specifically ERP, accounting, invoicing, payment, or settlement data—only when the module is explicitly activated and authorized by the customer.

7. Network Security

• HTTPS: All data in transit between the user and the platform is protected via secure HTTPS.
• Application Firewalls: OKTee’s cloud environments leverage platform protection layers designed to block common web attacks, including injections, unauthorized access attempts, and traffic abuse.
• Security Headers: Modern security headers are enforced to protect users from browser-side threats.
• Environment Segregation: Production, staging, and development environments are completely isolated from each other.
• Secrets Management: API keys, infrastructure credentials, and security secrets are stored using secure environment managers and never committed to code.

8. Security Incident Management

OKTee maintains an Incident Response Plan covering the identification, containment, mitigation, and communication of potential security events.

• Detection and triage of security anomalies
• Assessment of scope and operational impact
• Containment and remediation actions
• Proactive notification to affected customers when an incident impacts customer data
• Reasonable assistance to help customers meet their own regulatory disclosure obligations
• Post-incident review and preventive security hardening

If you suspect any unauthorized access or security breach involving your Amazon or OKTee data, please contact us immediately at: privacy@oktee.io

9. Secure Development Practices

• Code Reviews: Significant code changes undergo peer review prior to production deployment.
• Dependency Scanning: OKTee monitors dependencies for known vulnerabilities and security alerts.
• Secrets Detection: Automated checks ensure API keys, certificates, or credentials are never checked into git repositories.
• Vulnerability Remediation: Critical security issues are prioritized and addressed on an expedited cycle.
• Performance Logging: Runtime errors are tracked using secure tools to rapidly identify and address anomalies.

10. Authentication & Password Security

• User accounts are accessed using secure authentication protocols.
• Passwords are hashed; plain text values are never stored.
• Internal OKTee platform access is restricted to authorized operations staff.
• Sharing user credentials among team members is strictly prohibited.
• Advanced authentication layers can be activated based on organization and enterprise tenant requirements.

11. Sub-Processors & Data Transfers

OKTee partners with technical subprocessors to deliver core services, including marketing site hosting, application hosting, databases, background sync workers, workflow orchestration, application performance monitoring, AI tools, or public PDP monitoring.

Certain partners may process data outside the European Economic Area. Where required, such transfers are protected by standard contractual frameworks, specifically European Commission Standard Contractual Clauses (SCCs).

Core Technical Sub-Processors

A comprehensive list of our subprocessors is available on the dedicated Subprocessors Page.

12. Compliance & Standards

13. Vulnerability Disclosure

If you identify a potential security vulnerability within our platform, please disclose it to us responsibly at: privacy@oktee.io

OKTee is committed to investigating reports thoroughly and addressing critical security concerns on an expedited schedule.

14. Security & Compliance Contact

See also: Privacy Policy · Subprocessors · DPA · Amazon Integration Overview