Security
Draft notice — advanced draft: this document faithfully reflects bepleez's actual practices at this stage of development. Sections in brackets are placeholders to be finalized once the SASU is incorporated. This text has not yet been reviewed by counsel.
bepleez negotiates on your behalf with your buyers, and in doing so handles your catalog, margin, and commercial strategy data. This page describes plainly how we protect that data today — at our stage as a startup, not by claiming a maturity we don't yet have.
1. Encryption
All data travels over HTTPS/TLS between the widget, our API, and your store. Data at rest is encrypted at the level of our database (Supabase / PostgreSQL) and our cache (Upstash Redis).
2. Access control
Access to our production systems is role-based (RBAC): only people who need it to operate the Service have access, and that access is individual and traceable. Your Merchant account authentication is handled by Clerk, with two-factor authentication support.
3. Where your data lives
| Function | Provider | Role |
|---|---|---|
| Application hosting | Railway, Vercel | Running the API and dashboard |
| Database | Supabase (PostgreSQL) | Storing account, catalog, and negotiation data |
| Cache | Upstash (Redis) | Performance, temporary data |
| Authentication | Clerk | Account and session management |
| Negotiation AI model | OpenAI | Generating offers, based on your guardrails |
| Market intelligence | PricesAPI | Competitive pricing signals (product data, not buyer data) |
| Transactional email | Resend | Account notifications |
| Error monitoring | Sentry | Technical incident detection |
This is the same list published in our Privacy Policy — it evolves as our infrastructure does. None of these providers is authorized to use your data for any purpose other than running the Service.
On AI: data sent to our model provider to generate an offer is not used by that provider to retrain its own models, per its API terms of use. Separately, bepleez may use aggregated and anonymized negotiation data to improve its own model — this processing is described and governed in our Privacy Policy (Section 3.2), with a right to object available from your dashboard.
4. Transaction integrity — the Deal Token
Every accepted negotiation generates a Deal Token: a cryptographically signed, time-limited certificate encoding the exact terms of the offer (product, price, quantity, validity window). It cannot be replayed past expiry, forged, or reused outside the negotiation it was issued for. We maintain audit trails for negotiation and acceptance events, available for review in the event of a transaction dispute.
5. Incident management
Our production systems are continuously monitored (Sentry) for technical anomaly detection. In the event of an incident affecting your data or your buyers' data, we commit to notifying you as promptly as possible and in line with applicable legal obligations (including Article 33 of the GDPR where it applies). A suspected incident can be reported at any time to security@bepleez.com (mailbox to be confirmed).
6. Responsible disclosure
If you identify a security vulnerability in bepleez, please report it responsibly to security@bepleez.com (mailbox to be confirmed) before any public disclosure, so we can fix it. We commit to acknowledging your report promptly and keeping you informed as it's resolved.
7. Certifications
bepleez is a young company and does not currently hold formal certifications (SOC 2, ISO 27001). We follow the good practices described above from day one, and will consider a formal certification path as our customer base and compliance needs grow — particularly for our larger accounts.
8. AI compliance (EU AI Act)
bepleez's negotiation agent uses artificial intelligence to interact with your buyers. In accordance with Article 50 of the EU AI Act, the buyer is informed that they are negotiating with an artificial intelligence system, not a human.
Our design guardrails also limit the risk of prohibited practices under Article 5 of that regulation: negotiation thresholds are set by the Merchant, never inferred from a buyer's protected characteristics (age, disability, socio-economic situation), and an offer can never exceed the listed price.
9. Contact
For security questions: security@bepleez.com (mailbox to be confirmed). For questions about your personal data, see our Privacy Policy.