Security and data

What we store

• Your account: name, email address, and a salted hash of your password (we never store the password itself).
• The products you enter: SKU codes, names, HS codes, countries of origin, costs, selling prices, and your margin history.
• Your alert settings, and, if you add one, your Slack webhook URL.

We do not ask for your customs broker login, your marketplace credentials, or your bank details. Payments are handled by Stripe; card numbers never reach our servers.

How it is protected

• Encrypted in transit. All traffic uses HTTPS, and browsers are told to only ever connect that way.
• Your Slack webhook is encrypted before it is stored (AES-256-GCM), shown back to you only in masked form, and decrypted only at the moment an alert is sent. We accept only genuine Slack webhook addresses.
• Strictly separated accounts. Every query for your products, history and alerts is scoped to your workspace, and tests check that one account cannot read or change another’s.
• Sensible sign-in rules. Passwords need at least ten characters, sign-in attempts are rate-limited, and password-reset links expire after an hour.
• Browser protections. We send a Content-Security-Policy and other standard headers that block framing and content sniffing.
• Tariff updates are monitored. If a tariff feed stops updating or fails repeatedly, we are alerted. A missed rate change would leave your figures wrong without anyone noticing, so we treat it as an outage.

What we do with your data

We use it to run Marginify for you. Nobody at Marginify opens your products or figures unless you ask us to for support. We do not sell your data, and we do not share your costs or margins with anyone, including other users. See the privacy policy for the full picture.

Accuracy: estimates, not advice

Every figure is an estimate for planning. Marginify is not a licensed customs broker and does not make customs-compliance determinations. Each result lists its assumptions, for example when a preferential trade-agreement rate was applied, so you can check it against your broker’s entry.

What we have not built yet

We would rather you know now than find out later.

• Two-factor authentication is not available yet.
• There is one login per workspace; team members and roles are not available yet.
• No third-party security audit has been performed.

Report a problem

If you find a security issue, email [email protected]. Please give us a reasonable chance to fix it before sharing details publicly.