Rhodium OS / Security
How we protect your data
These are the controls in place today for every Rhodium OS account. Questions about them go to security@abox.agency.
Encrypted everywhere
All data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256.
Tokens in a secrets manager
Amazon access tokens and app credentials are stored in AWS Secrets Manager, never in code or spreadsheets, and are rotated on schedule.
Named staff only, with MFA
Only named Rhodium OS staff who need access to support your account can view it. Access uses role-based permissions and multi-factor authentication.
Each account kept separate
Each seller's data is logically separated. One customer can never see another's data.
AWS, Mumbai (ap-south-1)
Data is hosted on AWS in the Mumbai (ap-south-1) region, behind firewalls with only required ports open.
Monitored and logged
Access and system events are logged and kept for 1 year, with alerts on unusual activity.
Vulnerability management
Dependencies and servers are patched regularly, with security scans monthly.
Written response plan
If a security incident affects Amazon data, we notify Amazon at security@amazon.com within 24 hours of detection and inform affected customers.
Kept only as long as needed
We delete data on request or within 30 days of disconnection, as set out in our Privacy Policy.
Report a security issue: email security@abox.agency. We acknowledge reports within one business day.