You are handing us
the keys to your shop
Connecting Arub means giving it access to your orders, your buyers' addresses and your carrier accounts. That deserves a page written for you to read rather than a badge in a footer. Here is what we hold, where it sits and who can reach it.
Your own instance
Each customer's data lives in its own database rather than a shared table with a customer column. A query in your instance cannot reach another customer's orders, because the other customer's orders are not in it.
Hosted in the United States
On servers we run ourselves, not resold space with an unknown neighbor. Traffic is HTTPS only and older plain-HTTP requests are redirected before they reach the app.
Nothing is sold
Your data and your buyers' data are not sold, rented or shared with advertisers, and they are not used to train anybody's model. We make money from subscriptions, not from what is in your orders.
| What | How it is held |
|---|---|
| Marketplace connections | Authorized through each marketplace's own consent screen. Arub holds a token for the shop, never your marketplace password, and you can revoke it from the marketplace at any time. |
| Carrier credentials | Stored to be used against the carrier's API and shown back to you only as a masked value. Removing a carrier removes them. |
| Your Arub password | Hashed, never stored in a readable form, and never emailed to you. A first-login password must be changed before anything else can be done. |
| API keys | Shown once when created, stored hashed afterward, and revocable at any moment. A key carries the same permissions as the account it belongs to, so a read-only key really is read-only. |
| Buyer addresses | Kept because a shipping tool cannot work without them, visible only to users of your instance, and removable on request when a buyer asks. |
| What your team can see | Granular per-feature permissions, individually or through reusable groups. A packer can be given labels and nothing else — not reports, not billing, not customers. |
| What we can see | Support staff reach your instance only to answer something you have raised, and every API call is written to a request log you can read yourself. |
What we are not claiming
There is no SOC 2 report, no ISO certificate and no penetration-test letter to send you. Those cost real money and a young product has not earned the right to imply it has them.
What there is instead: a small team, a single-tenant design, a product built to the data-protection requirements the marketplaces audit us against, and a written policy for each of them. If your own compliance process needs something specific before you can connect a shop, ask — a straight "not yet" is a likely answer and you deserve to hear it before you sign up rather than after.
If something ever does go wrong with your data, you will hear it from us, in plain words, with what happened and what we did. Not a status page edit three days later.
The long versions
Each of these opens with a plain-English summary before the legal text starts: the Privacy Policy, the Terms and Conditions, and the Amazon Data Handling Policy that sets out exactly what Amazon order data is collected, where it flows and how long it is kept.
Questions before you connect anything?
Ask them first. We would rather answer a hard security question than have you guess at the answer.