Reporting security and privacy issues

Please tell us if you find or suspect any of the following:

• A security vulnerability in rainsight.io, app.rainsight.io, or anything else Rainsight runs.
• A concern about how we collect, use, or store personal information.
• Any actual or suspected misuse of, or unauthorized access to, Amazon data held by Rainsight. That includes seller data from Amazon's Selling Partner API and, once our Amazon Ads integration is live, advertising data.
• A Rainsight account you think someone else has accessed.

If you are not sure whether something counts, report it anyway. We would rather hear about it.

Email support@rainsight.io with “Security” in the subject line. Customers who are signed in can also use Contact support in the app and choose “Security or privacy concern”, which sends the report to the same inbox.

A useful report includes:

• What you found, and the page, URL, or feature where you found it.
• Steps to reproduce it, if it can be reproduced.
• What you think someone could do with it.
• How we can reach you, if not at the address you write from.

1. We confirm we have it. We aim to reply within one business day to say your report has reached a person.
2. We assess it. We work out whether the issue is real, how serious it is, and whether any customer or Amazon data was affected. Anything that could expose customer or Amazon data goes to the front of the queue.
3. We track it until it is resolved. Every report is logged from the day it arrives until it is closed, with a named person responsible for it. We will keep you updated while we work on it.
4. We fix it. If we can contain the problem before a full fix is ready, we do that first.
5. We tell the people affected. If customer data was affected, we notify the affected customers. If Amazon data was involved, we notify Amazon, as our agreements with Amazon require. We also meet any legal notification obligations that apply.
6. We close it out. We tell you when the issue is resolved, record what happened and what we changed, and fix whatever allowed it to happen.

Rainsight reads data from Amazon to produce reports. It does not change anything in your Amazon account. We use Amazon data only to provide Rainsight to you, and we do not sell it.

• The credential that lets Rainsight read your Amazon data is encrypted with AES-256-GCM before it is stored. The short-lived access tokens Amazon issues from it are never written to our database.
• Passwords are hashed with Argon2id. We never store them in readable form.
• Sign-in sessions are stored only as one-way hashes, so a copy of our database would not contain usable sessions.
• Error reports are scrubbed of credentials and tokens before they are sent to our error-tracking provider.
• Traffic to rainsight.io and app.rainsight.io is encrypted in transit with HTTPS.

You can ask us to delete your data at any time. Our Privacy Policy explains what we collect and how long we keep it.

We welcome reports from security researchers. While testing, please:

• Use only accounts you own or have permission to test.
• Stop as soon as you reach data that is not yours. Do not view more than you need to show the problem, and do not copy, change, or delete it.
• Avoid anything that degrades the service for our customers, such as denial-of-service testing, automated scanning at high volume, or spam.
• Do not attempt phishing or other social engineering of our team or customers.
• Give us a reasonable chance to fix the issue before you share it publicly.

If you follow these guidelines in good faith, we will not take legal action against you over your research, and we will work with you to understand and fix the issue. We do not run a paid bug bounty, but we are glad to credit you once a fix is out, if you would like that.

If you think someone else has accessed your Rainsight account, change your password and email support@rainsight.io right away. We can end every active session on your account.

You can also remove Rainsight's access to your Amazon account at any time from Seller Central. Doing so revokes the credential Rainsight uses to read your data.

Security and privacy reports: support@rainsight.io, subject “Security”.
General questions: see our support page.

We review this page whenever our process changes, and at least every six months.