Closo manages marketplace credentials for thousands of sellers. We take that responsibility seriously. This article explains the specific protections in place. We update it whenever those protections change.
Encryption at rest
When we store any marketplace token on our servers — eBay refresh token, Shopify OAuth token, or temporary harvest envelopes — we encrypt it before writing to the database. We use libsodium's secretbox primitive (XSalsa20-Poly1305 authenticated encryption). Each token is encrypted with a versioned key derived per-seller, per-purpose, so even with database access an attacker would need our master key to read anything.
The master encryption key is held in a single secrets store with audit logging. Rotation cadence is quarterly. The versioned key layout in our database means old data can be re-encrypted to a new key without re-collecting from sellers.
Never logged
Our logging system has a structured redactor that runs on every log line before it leaves the application. Anything matching token, cookie, password, or authorization-header patterns gets replaced with a redaction marker. The same applies to our error-tracking system — when error tracking is enabled, credentials are stripped from breadcrumbs and request bodies before anything is recorded.
When something does go wrong and a Closo engineer pulls logs, they see anonymized values, not your tokens. We've enforced this with code review and a regression test that scans recent log output for credential-shaped strings.
Your browser, your session
The active logged-in session for Poshmark, Depop, Mercari, and Vinted lives in your browser's cookie jar. We don't copy it server-side in a way that we could replay against the marketplace. When our extension needs to act, it acts from your browser using cookies your browser already has — we orchestrate, we don't impersonate.
For eBay and Shopify, we do hold OAuth tokens server-side (because those marketplaces' APIs require it). Those are the ones encrypted at rest per the section above. Even then, we keep refresh tokens (long-lived) separate from access tokens (short-lived) in the database, so a leak of one class doesn't compromise the other.
Defense in depth
On top of encryption and redaction, we have:
Mandatory code review
Production access audit
Rate limits everywhere
Reporting concerns
If you find anything that doesn't match this article, or you see evidence of a problem, email security@closo.co. We respond within 24 hours on weekdays. For active incidents we have a 1-hour SLO.
Open Marketplaces