Security and data protection

Every account used to access client data requires a second factor. This includes company email and productivity accounts, every marketplace we work in (Amazon Seller Central and Vendor Central, Walmart Seller Center, eBay, TikTok Shop and Shopify), every advertising account we run (Amazon Ads, Google Ads, Meta and the programmatic platforms), our analytics infrastructure, and all internal business systems. Accounts that cannot enforce MFA are not approved for use with client data.

Company accounts are centralised behind single sign-on where the platform supports it. Where it does not, credentials are generated and stored in a company-managed password manager with enforced complexity requirements. Employees do not store client credentials in browsers, spreadsheets, shared documents or personal password tools.

Wherever a platform supports it, we work inside your account under our own named user with a defined permission level. We do not ask you to share a password. On Amazon that means user permissions in Seller Central or Vendor Central; on Walmart, eBay, TikTok Shop and Shopify it means a user, staff or collaborator account with the permissions the work needs and no more; on advertising and analytics platforms it means account-level user invitations. Where a platform offers no delegated access at all, we say so before the engagement starts and agree how that account will be handled rather than working around it. This keeps every action attributable to an individual and lets you revoke our access instantly, without changing your own credentials.

Access is provisioned by role. New access is scoped to the narrowest level that allows the work to be done, and requires approval from the account lead.

We review who has access to which client accounts and internal systems on a recurring schedule and remove permissions that are no longer required. When an employee or contractor leaves, their access to company systems and all client platforms is revoked as part of a documented offboarding checklist completed on their final day.

All traffic to our website, client-facing dashboards and analytics platform is encrypted using TLS 1.2 or higher. Data moving between our systems and third-party platforms travels over encrypted connections.

Client data stored in our cloud infrastructure, databases and file storage is encrypted at rest using AES-256. Company laptops are protected with full-disk encryption, so data on a lost or stolen device is unreadable.

Company devices run current operating systems with automatic security updates, endpoint protection software, screen lock timeouts and remote wipe capability.

We request only the data and platform permissions the engagement requires. We do not download or retain customer personally identifiable information beyond what is necessary to deliver the service, and we do not use client data to train external models or to benefit other clients.

Employees complete background screening before starting. Every employee and contractor signs a confidentiality agreement covering client data, and we enter into data processing agreements with clients where their data protection obligations require one.

All staff complete security training at onboarding and on a recurring basis. Training covers phishing and social engineering, credential hygiene, safe handling of client data, and how to escalate a suspected incident.

Every employee knows how to report a suspected security issue and is expected to report immediately rather than investigate alone.

Xcelerate Brands uses established third-party platforms to deliver services, covering cloud infrastructure, analytics, communication and project management. Before a vendor is approved to handle client data, we review its security posture, its published certifications and its data handling and retention terms, and we put a written data processing agreement in place where required. We maintain an inventory of vendors that process client data. Clients under agreement can request the current list, along with our security documentation, from their account lead.

We maintain a documented incident response procedure with named owners at each stage, from detection and triage through containment, investigation, remediation and client notification to post-incident review. If we identify a security incident affecting a client's data, we notify the affected client without undue delay and no later than 72 hours after confirming the incident, and we provide what we know about scope, impact and remediation as the investigation progresses. The procedure is reviewed and tested annually.

Client data held in our systems is backed up on a recurring schedule, with backups encrypted and stored separately from production systems. Our critical platforms run on major cloud providers with redundancy and documented recovery objectives, and we maintain a continuity plan so client work continues through a disruption.

Xcelerate Brands has completed a SOC 2 Type II audit covering the Trust Services Criteria for Security, Availability and Confidentiality. The audit was performed by an independent CPA firm and confirms that the controls described on this page are in place and operated effectively throughout the audit period. Clients and prospective clients can request a copy of the report under NDA from their account lead or through the contact form. We undergo SOC 2 examination annually to keep the report current.

We handle personal information in line with applicable privacy law, including the GDPR and the CCPA/CPRA, and we support clients in meeting their own obligations as data controllers. Our Privacy Policy describes what we collect and why.

The Xcelerate Brands Analytics MCP is a service that lets authorised users query our analytics data through a connected AI assistant, such as ChatGPT, Claude, Microsoft Copilot or Gemini. The cards that follow explain what the Analytics MCP collects and how it is handled, in addition to the practices described elsewhere on this page and in our Privacy Policy.

Identity and access information (your work email address, your assigned role, and which client accounts you are authorised to access), which comes from our identity provider when you sign in and not from the AI assistant itself. The questions and queries you submit, meaning the natural-language questions or database queries you send through a connected assistant. Query results, meaning the data returned in response to your questions; depending on what you ask and which client account you are authorised to see, results may include business data about our clients, and in some cases personal information contained within a client's own records, such as names or contact details that exist in that client's data.

To authenticate you, confirm which client data you are allowed to see, run the query you asked for, and return the result through the AI assistant you are using. We also use limited technical information, such as error messages, to keep the service running correctly and securely.

The AI assistant you are using (for example OpenAI, Anthropic, Google or Microsoft) receives your question and the query result as part of generating its response to you, and processes it under its own privacy terms rather than ours; we recommend reviewing the privacy policy of whichever assistant you connect. Our infrastructure providers (cloud hosting and our identity provider) process this information on our behalf, to run the service. We do not sell this information, and we do not share it for advertising purposes.

A personal access token, if you generate one, remains valid for up to 30 days from issuance and then expires automatically. Short-lived session information used to confirm you are logged in is kept in memory for a few minutes and then discarded. We do not separately store the questions you ask or the results you receive; they are processed to answer your request and are not retained by the Analytics MCP afterwards. Operational logs, used for troubleshooting and security, are retained for a limited period and then automatically deleted.

You can end your session at any time, and you can ask us to revoke a personal access token through your account lead or the contact form.