Security and LGPD
You trust marketapi with access to your customers' stores. Here is how we look after it.
Security and LGPD
API keys
We store only the API key's hash. It shows once, when created, and you can revoke it at any time.
Encrypted tokens and secrets
Marketplace tokens, webhook secrets and your app's credentials are encrypted with AES-256-GCM.
Authorization on the marketplace
The seller authorizes on the marketplace's own screen. Their password never goes through us. Where the marketplace supports it, the flow uses PKCE.
Signed webhooks
Every delivery carries an HMAC-SHA256 signature with a timestamp. Your server checks it and refuses old deliveries.
Isolation per account
Each API key only sees its own account. Sellers and data of another account do not exist for it.
Buyer data
Orders carry no personal data. Name, tax ID and address come out of their own route, every read is logged and the fields are deleted after the retention period (default: 90 days after the order closes).
Payments
The card is registered on Stripe and never goes through our servers.
LGPD
Seller and buyer data are processed only to run the integration you asked for. Roles and obligations are in the data processing agreement.
Found a vulnerability?
Write to contato@marketapi.shop with the details. We will reply and let you know when it is fixed.
Your first 5 sellers are free.
Create the account, generate an API key and connect your first seller today.