Security

Sellers trust ExperShip with their shipping data, their customers' addresses and access to their carrier accounts. This page explains how we protect that data and how to tell us if you find a security problem in our website, app or API.

Our approach

We keep security practical: collect only the data we need to ship your orders, protect it in transit and in storage, limit who can reach it, and fix problems quickly when we find them. We do not claim security certifications we do not hold. If you need details for a security review, contact us.

Data protection

• Encryption in transit. Traffic between your browser or your code and ExperShip is encrypted with TLS (HTTPS).
• Encryption at rest. Our databases, file storage and backups are encrypted at rest.
• Data minimization. We collect the shipping, customs and account data needed to provide the service. Our Privacy Policy lists what we collect and why.

Infrastructure

The ExperShip app, the API and this website run on Amazon Web Services (AWS) in the US East (N. Virginia) region, so customer data is stored in the United States. AWS provides the physical security, network protection and data center controls for the infrastructure we build on.

Account security

• Passwords. We store passwords only as salted hashes, never in plain text. Nobody at ExperShip can see your password.
• Two-factor authentication. Two-factor authentication (2FA) for ExperShip accounts is on our roadmap. Until it is available, a unique, strong password is your best protection.
• Your part. Use a unique, strong password, and do not share your sign-in with others on your team; give each person their own access where the app supports it.

API security

The ExperShip API is authenticated with API keys. To keep your account safe:

• Keep your API keys secret. Store them on your server, never in browser code, mobile apps or public repositories.
• Rotate a key straight away if you think it has been exposed, and rotate keys from time to time as a habit.
• Call the API over HTTPS only.

ExperShip gives you separate test and live API keys, so you can build and test without creating real shipments. You can rotate keys yourself from the dashboard, the API is rate limited to protect the service from abuse, and webhooks are signed so your server can verify that an event really came from ExperShip before acting on it.

Payments

Card details are handled by our payment processor. We do not store full card numbers on ExperShip systems.

Access control

Access to production systems and customer data is limited to the people who need it for their role, and is removed when it is no longer needed.

Backups and incident response

We back up customer data regularly so it can be restored if something goes wrong. If a security incident affects your data, we investigate, contain it and notify affected customers as required by law.

If you believe your ExperShip account has been compromised, change your password, rotate your API keys and email info@expership.com right away.

Subprocessors

We use a small number of service providers to run ExperShip, such as cloud hosting, email delivery and payment processing. The categories of providers and what they receive are listed in How your information is shared in our Privacy Policy.

Vulnerability disclosure policy

We welcome reports from security researchers and customers. If you find a vulnerability, please tell us privately so we can fix it before it can be abused.

Scope

• expership.com and www.expership.com
• app.expership.com
• The ExperShip API

Out of scope: third-party services we use (for example carriers, our hosting provider or our payment processor), which have their own disclosure programs, and reports with no security impact, such as missing best-practice headers without a working exploit.

How to report

Email info@expership.com with the subject "Security report". Please include:

• A description of the issue and the impact you believe it has.
• The affected URL, endpoint or feature.
• Clear steps to reproduce it, with screenshots or a short proof of concept if you have one.
• How we can reach you for follow-up questions.

Our commitments

If you report in good faith and follow the rules below, we will:

• Acknowledge your report and let you know we are looking into it.
• Keep you updated as we investigate and fix the issue.
• Not take legal action against you for security research that follows this policy.

Rules of engagement

• Do not access, change or delete data that is not yours beyond the minimum needed to show the issue. If you reach personal data, stop and tell us.
• Do not run denial-of-service tests or anything that degrades the service for others.
• No social engineering or phishing of ExperShip staff or customers.
• No physical attacks against offices, data centers or people.
• Use only accounts you own or have permission to use.
• Give us reasonable time to fix the issue before you disclose it publicly, and agree the timing with us.

We do not run a paid bug bounty program at this time.