How we protect your data and keep Car Parts Marketplace secure.
All data stored in our databases is encrypted at rest using AES-256. This includes user profiles, session data, and all other sensitive information.
Every connection to Car Parts Marketplace is encrypted with TLS 1.3. We enforce HTTPS across all endpoints and use HSTS headers to prevent downgrade attacks.
Passwords are hashed with bcrypt and never stored in plain text. We use secure, HttpOnly cookies with the __Secure- prefix for session management.
Auth endpoints are rate-limited per IP. After repeated failed login attempts, accounts are temporarily locked to prevent brute force attacks.
Sessions expire after 7 days. Suspicious activity triggers automatic session revocation. You can view and revoke any session from your account settings.
Hosted on Vercel (edge network) with Neon (PostgreSQL). All providers are SOC 2 compliant. We run on isolated environments with automated deployments.
Car Parts Marketplace uses Noarka's SSO system for authentication. When you sign in, your credentials are verified and a short-lived authorization code is generated. This code is exchanged for a signed JWT (HMAC-SHA256) that contains your user ID, email, and role.
JWTs are stored as HttpOnly cookies and expire after 7 days. The __Secure- prefix is used on HTTPS connections to prevent cookie theft via man-in-the-middle attacks.
Database: PostgreSQL on Neon with encryption at rest. Connection pooling via Prisma. Automated backups.
File Uploads: Stored in the application directory with access controls. Uploads are validated by file type and size (max 10MB).
Payment Data: Card details are tokenised by Stripe. We never store raw card numbers, CVVs, or full expiration dates. Only the last four digits and card brand are retained.
Passwords: Hashed with bcrypt (12 rounds). We cannot see or recover your password. Password reset links expire after 1 hour and are single-use.
All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. Your financial information is encrypted, tokenised, and handled in compliance with the highest security standards.
Car Parts Marketplace has zero access to your raw card number, CVV, or bank account details. Sellers receive payouts via Stripe Connect, ensuring bank details are never exposed to our platform.
We maintain comprehensive audit logs for all security-sensitive actions including:
Suspicious login attempts are tracked by IP and email. Known devices are remembered, and new device logins trigger additional verification.
In the event of a security incident, we follow these steps:
If you discover a security vulnerability, please report it to security@carpartsmarket.com.au. We take all reports seriously and will respond within 48 hours.
Car Parts Marketplace is designed with privacy and security in mind. We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988. Our infrastructure providers (Vercel, Neon, Stripe) are SOC 2 Type II compliant.
We do not sell personal data. We do not use your data to train AI models. You can request deletion of your account and all associated data at any time.
