Security

Security Practices

Gifts In Seller Tools is designed around OAuth authorization, least-privilege access, and careful handling of Etsy seller data.

The term 'Etsy' is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

Security Controls

The application will not collect Etsy passwords. Shop access must be authorized through Etsy OAuth 2.0.

Refresh tokens are planned to be encrypted at rest and deleted when a shop disconnects or deletion is verified.

Initial scopes should stay limited to approved shop, listing, and order workflow testing needs.

The public site and future callback endpoints must load over HTTPS.

Administrative access should be restricted, logged, and reviewed.

The future app should respect Etsy API rate limits and back off when responses require it.