Security

1. Our program

OnBreeze keeps a written information security program. It follows the five functions of the NIST Cybersecurity Framework: identify, protect, detect, respond and recover. We review it at least once a year and after any incident.

We hold no security certification, and no outside firm has assessed the Service. This page does not promise any level of uptime.

2. Protecting data

• All traffic to the Service uses HTTPS, and the Service sends a strict transport security header.
• Our platform providers encrypt stored data at rest.
• Walmart API keys are held in Google Secret Manager. The Service never shows them again and never puts them in chat, logs or usage reports.
• The Service masks buyer names, contact details and street addresses in order and return reads.
• Support records and logs exclude credentials, customer contact information, payment details and signed download links.

3. Keeping sellers apart

• Every database query for seller data binds the workspace and, where it applies, the connection. Missing or unknown input is refused.
• Captured data sits in a database with row-level security forced on every table. A query without the seller’s identity returns nothing.
• We run automated tests that try to read one synthetic seller’s data as another.
• Calculated views use one seller’s data and go only to that seller.

4. Controlling access

• The private service accepts calls only from its own service identities, through Google Cloud IAM, with short-lived tokens. The runtime services use no stored service account key.
• Each workspace has roles: owner, admin, member and viewer. Browser actions check the same origin and a CSRF token. Sensitive actions need a recent sign-in.
• AI clients get access through OAuth. You choose the Walmart Marketplace accounts and permissions, and you can revoke access at any time.
• Each workspace has an audit log. Each entry links to the one before it, so a changed or deleted entry shows.
• Operator views use a separate role and show redacted records. We log operator access to request details.

5. Safe changes

• Production changes stay off until an owner or admin turns them on.
• A change shows an exact preview before anyone approves it. By default a person approves it in a browser.
• Limits can cap changes per day, price movement, inventory movement and money.
• The private service checks the production decision again before it calls Walmart.
• One control can revoke all agent autonomy at once.

6. Monitoring and recovery

• We run health checks, an hourly self-check of production settings, and operator alerts for failed report ingestion and repeated read failures.
• Request limits and spending cutoffs apply per workspace and across the Service.
• Captured data has daily backups and seven days of point-in-time recovery. We restored it into a separate instance in a drill on October 30, 2026.

7. Incidents

We keep a written incident procedure. We contain the problem, notify, preserve evidence, fix the cause and review the result.

We notify affected customers within 72 hours after we confirm a data incident, as the Data Processing Addendum says. We also notify Walmart as its terms require.

8. Report a security problem

Email team@getonbreeze.com or use the contact page. Do not include API keys, passwords or customer details. Do not test against another seller’s data.