Security at SellSutra

Last updated: 5 October 2026

SellSutra handles sellers' order data, which includes their customers' personal details. These are the safeguards we build in, and the standards we hold ourselves to.

1. Hosting and data location

SellSutra runs on a major cloud provider's Indian region. Customer data is stored in India.

2. Encryption

All traffic uses HTTPS (TLS 1.2 or higher), with HSTS enabled.
Data is encrypted at rest, including backups.
Marketplace tokens and API keys are kept in a secrets manager, never in code.

3. Access control

Every seller's data is kept separate from every other seller's.
Role-based access inside each account, so staff see only what they need.
Two-factor login for Beact staff, with least-privilege access to production.

4. Monitoring and logs

Audit logs of actions on seller data, kept for at least one year.
System logs kept in India for 180 days, in line with CERT-In directions.
Clocks synchronised to Indian time servers for accurate records.

5. Backups and recovery

Daily encrypted backups, with restores tested regularly.

6. Marketplace access

SellSutra connects to marketplaces only through official APIs or report files the seller uploads. We never ask for or store marketplace passwords, and sellers can revoke access at any time.

7. Incident response

We have a written incident response plan. Cyber incidents are reported to CERT-In within 6 hours, and affected sellers are informed promptly so they can meet their own reporting duties under the DPDP Act.

8. Testing

We run independent vulnerability assessment and penetration testing (VAPT) on SellSutra and fix findings before release.

9. Report a vulnerability

If you find a security issue, please email jignesh@beactinfotech.com with the subject "Security report". We will acknowledge it within 2 business days. Please do not access other people's data or disrupt the service while testing.