Security & Incident Response

Data is hosted on Neon (Postgres, encrypted at rest and in transit) and Vercel (application hosting, HTTPS-only). Payments and payouts run through Stripe; authentication runs through Clerk. We don’t operate our own servers or store data on any system outside these providers.

We monitor for unusual activity through our hosting and database providers’ built-in alerting, and through Stripe and Clerk’s own fraud and account-security monitoring. Anyone — staff, a seller, or a maker — can report a suspected security issue at any time by contacting us.

When a security incident affecting personal data is confirmed, we will:

• Contain it — revoke the affected credentials or access, and patch the underlying cause.
• Assess what data was involved and who’s affected, using our database’s point-in-time history to determine the scope.
• Notify affected sellers and, where required by law, affected individuals and regulators — without undue delay, and in any case within the timeframes required by applicable law.
• Rotate any credentials or API keys that may have been exposed.
• Document the incident, its cause, and the fix, so the same gap can’t reopen.

To report a security concern, contact us through the email listed in your account settings.