Security

Security is part of how Xylem Strategic, LLC builds Xylem: authenticated access, workspace isolation, encrypted transport, and server-side handling of secrets. We describe controls that exist in the product. We do not claim certifications or monitoring programs we have not completed.

• Encrypted transport. The application is intended to run over HTTPS in deployed environments.
• Authentication. User authentication is provided through Supabase Auth with session cookies managed via server-side session refresh.
• Workspace isolation. Application data is scoped to workspaces. Database Row Level Security (RLS) policies restrict access to members of the relevant workspace.
• Least-privilege application access. Browser clients use public anon/publishable keys only. Service-role keys, when used, remain server-only and are never shipped to the browser.
• Secrets in environment variables. API credentials and provider secrets are loaded from environment configuration, not hardcoded in the repository.
• Managed infrastructure encryption. Data stored in Supabase relies on the encryption-at-rest and platform controls provided by that managed service and its underlying cloud provider.
• Dependency review. The project uses standard package management. Security updates are applied as part of ordinary maintenance; automated scanning may be expanded over time.

Amazon authorization tokens are stored and used only on the server, and they are not exposed to client-side JavaScript. Today that means Selling Partner API refresh tokens for Amazon Seller Central. We do not ask for or store your Amazon account password. Xylem does not currently store Amazon Ads API tokens, because that connection is not available yet. When you authorize an Amazon Ads connection, those authorization tokens will be stored and used the same way: server-side only. Disconnecting a connection from Settings marks it disconnected and is intended to stop further synchronized use of that authorization.

Manual marketplace account records can also be removed by workspace owners and admins from Brands & Channels.

If you believe you have found a vulnerability in Xylem, please report it responsibly at support@growwithxylem.com. Include enough detail to reproduce the issue. Please do not access data that is not yours or disrupt the Service while testing.

Privacy and deletion requests use a separate path: Data requests.