Enterprise Data, API and Operational Pricing Security
XPrice runs on an end-to-end security architecture: from AES-GCM encryption of your marketplace API keys to full tenant-level isolation of your commercial cost data and multi-layer execution modes that protect your store prices (Shadow, Approval and Margin-Floor-Locked Autopilot).
Deployment options
On-Premise Deployment
Cloud Deployment
Custom Enterprise Architecture
Security layers in place
The core security layers that protect your store data, integration keys and marketplace operations:
Authentication and Role-Based Access Control (RBAC)
Passwords are never stored in plain text; they are protected with industry-standard cryptographic hashing.
TOTP-based Two-Factor Authentication (2FA) and secure recovery codes are supported.
Strict Role-Based Access Control (RBAC) is enforced at user, administrator and company membership levels.
Enterprise accounts enforce a mandatory password reset on first sign-in and session security policies.
Marketplace API and Integration Secret Security (AES-GCM)
Your Trendyol and marketplace API credentials (API Key / Secret) are stored encrypted with a versioned AES-GCM encryption layer.
Encrypted integration keys are never returned in plain text in any API response or interface.
Critical infrastructure keys are managed through isolated environment variables, independent of the code base.
No cross-access is possible to any integration or store record outside the company scope.
Trade Secret and Multi-Tenant Data Isolation
Each store's "Unit Cost Including Shipping", profit margin, sales history and strategy data are fully isolated at the database layer by company identity (Tenant ID).
A store's cost or sales data is never shared with third-party sellers and is never used to train another store's AI model.
Pricing analyses and simulation history can only be viewed within the authorized company workspace.
Operational Pricing Security and Margin Protection Locks
Read-Only Shadow Mode: unless you explicitly grant permission, XPrice performs no write operation on your marketplace listing prices; you can monitor analyses with zero risk.
Approval and Autopilot Mode control: price updates run either with your one-click approval from the panel or only within the safe lower/upper price limits you define.
Hard Floor Guardrail: no price below the minimum margin limit, calculated from unit cost including shipping, commission tier and active coupon/basket discount load, is ever published in any scenario.
Network, API and Request Security
All data communication in production runs under HTTPS / TLS encryption.
Automatic request limiting (rate limiting) and brute-force protection are applied to API and authentication endpoints.
Enterprise deployments can configure firewalls, IP restrictions (IP whitelisting) and private network access rules.
Payment and Subscription Security (Stripe)
Your card details are never stored or processed on XPrice servers.
International payments are processed by Stripe on behalf of XPRICE LTD — 256-bit SSL & PCI-DSS Level 1 compliant via Stripe.
All payment and billing notifications pass cryptographic signature verification and duplicate-charge prevention (idempotency) checks.
Verifiable security controls
Data protection, encryption and access control standards actively applied in the XPrice architecture:
SaaS, on-premise or a custom enterprise topology, evaluated case by case
Payment data
Card data is never stored by XPrice; payments are processed by Stripe
Credentials
Sensitive integration fields are kept encrypted and removed from API responses
Price intervention control
100% seller control with Read-Only Shadow Mode, One-Click Approval Mode and the Margin Floor Lock
Enterprise SLA and support
Priority SLA according to plan scope and 24/7 technical support under an enterprise contract
Contracting entity
International (non-Turkey) customers contract with XPRICE LTD. Payments are collected in USD through Stripe; your billing country at checkout determines the binding entity and payment provider.