Security at Wrenlist
Your stock, your sales history and your marketplace connections are your livelihood. Here is exactly how we look after them — in plain English, with nothing aspirational.
Where your data lives
Wrenlist runs on Vercel, and your data is stored in a dedicated Postgres database hosted by Supabase in the EU (AWS eu-west-1, Ireland). Everything travels over HTTPS/TLS — there is no unencrypted path to Wrenlist.
Your inventory is isolated at the database layer
Every table enforces row-level security: each query is scoped to your account by the database itself, not just by application code. One seller can never read another seller's finds, sales, costs or messages — the database refuses, even if a bug asked it to.
Marketplace connections are encrypted at rest
The tokens and session credentials that let Wrenlist list and delist for you (eBay, Vinted, Depop and the rest) are stored encrypted with AES-256 and decrypted only server-side at the moment they are used. For marketplaces connected through the browser extension, you sign in on the marketplace's own site — Wrenlist never sees or stores your marketplace passwords.
We never touch your card details
Subscriptions are processed by Stripe. Card numbers go straight from your browser to Stripe and never pass through or rest on Wrenlist's servers.
Sign-in
You sign in with Google or with an email address. Email passwords are salted and hashed by our authentication provider (Supabase Auth) — stored in a form nobody, including us, can read back.
Deletion is real deletion
Deleting your account from Settings purges your inventory within 30 days; billing records are kept only as long as tax law requires. Your rights and the exact process are on the GDPR & Your Rights page.
Audit trails and monitoring
Marketplace actions (publishes, delists, sales, deletions) are written to append-only audit logs, and automated daily checks watch for silent failures — a delist that didn't stick, a sale recorded twice, a database change that never landed. Service health is public at wrenlist.com/status. The database is backed up automatically every day.
Certifications — an honest note
Wrenlist is a small, independent company. We don't yet hold formal certifications like SOC 2 or ISO 27001 — this page exists to state plainly what we actually do instead of renting a badge. Wrenlist LTD is registered in England & Wales (company no. 17381266).
Found a vulnerability?
Report it to admin@wrenlist.com and we will respond quickly. Please give us a reasonable window to fix an issue before disclosing it publicly — we take reports seriously and won't pursue anyone acting in good faith.