# Enterprise Data, API and Operational Pricing Security

XPrice runs on an end-to-end security architecture: from AES-GCM encryption of your marketplace API keys to full tenant-level isolation of your commercial cost data and multi-layer execution modes that protect your store prices (Shadow, Approval and Margin-Floor-Locked Autopilot).

- Canonical: https://xprice.ai/en/security
- Last updated: 2026-10-23
- Provider: XPRICE LTD (Registered in England and Wales) · Payments by Stripe in USD

## Deployment options

- On-Premise Deployment
- Cloud Deployment
- Custom Enterprise Architecture

## Security layers in place

The core security layers that protect your store data, integration keys and marketplace operations:

### Authentication and Role-Based Access Control (RBAC)

- Passwords are never stored in plain text; they are protected with industry-standard cryptographic hashing.
- TOTP-based Two-Factor Authentication (2FA) and secure recovery codes are supported.
- Strict Role-Based Access Control (RBAC) is enforced at user, administrator and company membership levels.
- Enterprise accounts enforce a mandatory password reset on first sign-in and session security policies.

### Marketplace API and Integration Secret Security (AES-GCM)

- Your Trendyol and marketplace API credentials (API Key / Secret) are stored encrypted with a versioned AES-GCM encryption layer.
- Encrypted integration keys are never returned in plain text in any API response or interface.
- Critical infrastructure keys are managed through isolated environment variables, independent of the code base.
- No cross-access is possible to any integration or store record outside the company scope.

### Trade Secret and Multi-Tenant Data Isolation

- Each store's "Unit Cost Including Shipping", profit margin, sales history and strategy data are fully isolated at the database layer by company identity (Tenant ID).
- A store's cost or sales data is never shared with third-party sellers and is never used to train another store's AI model.
- Pricing analyses and simulation history can only be viewed within the authorized company workspace.

### Operational Pricing Security and Margin Protection Locks

- Read-Only Shadow Mode: unless you explicitly grant permission, XPrice performs no write operation on your marketplace listing prices; you can monitor analyses with zero risk.
- Approval and Autopilot Mode control: price updates run either with your one-click approval from the panel or only within the safe lower/upper price limits you define.
- Hard Floor Guardrail: no price below the minimum margin limit, calculated from unit cost including shipping, commission tier and active coupon/basket discount load, is ever published in any scenario.

### Network, API and Request Security

- All data communication in production runs under HTTPS / TLS encryption.
- Automatic request limiting (rate limiting) and brute-force protection are applied to API and authentication endpoints.
- Enterprise deployments can configure firewalls, IP restrictions (IP whitelisting) and private network access rules.

### Payment and Subscription Security (Stripe)

- Your card details are never stored or processed on XPrice servers.
- International payments are processed by Stripe on behalf of XPRICE LTD — 256-bit SSL & PCI-DSS Level 1 compliant via Stripe.
- All payment and billing notifications pass cryptographic signature verification and duplicate-charge prevention (idempotency) checks.

## Verifiable security controls

Data protection, encryption and access control standards actively applied in the XPrice architecture:

UK GDPR · Stripe · 2FA · RBAC · AES-GCM · Rate Limit

## Operational principles

Management principles of our data privacy, deployment topology and operational support processes:
- **Security reports:** Logged via info@xprice.ai
- **Deployment model:** SaaS, on-premise or a custom enterprise topology, evaluated case by case
- **Payment data:** Card data is never stored by XPrice; payments are processed by Stripe
- **Credentials:** Sensitive integration fields are kept encrypted and removed from API responses
- **Price intervention control:** 100% seller control with Read-Only Shadow Mode, One-Click Approval Mode and the Margin Floor Lock
- **Enterprise SLA and support:** Priority SLA according to plan scope and 24/7 technical support under an enterprise contract

- Turkish version: https://xprice.ai/guvenlik