Built for stores that answer to auditors.
AutoReveals handles your listings, your conversations, and your logins the way an enterprise vendor should: audited infrastructure, encryption everywhere, and a design that never needs to keep your passwords.
We never store your credentials.
Not for marketplaces, not for the tools you connect. You sign in yourself, on the vendor’s own page. What we keep is an encrypted session, scoped to one tool and revocable in a tap.
Sign in, MFA, and CAPTCHA happen in an isolated browser showing the vendor’s real login page. Our systems never see the keystrokes and never hold the password.
The signed in session lives in a per dealer, per tool browser profile, encrypted at rest with keys held in a managed key service. One profile can never reach another store’s data.
Disconnect a tool and its session is destroyed immediately. Sign out of the vendor and Saif simply asks you to sign in again next time. Nothing lingers.
Audited infrastructure, end to end.
Every layer that stores or moves your data runs on infrastructure examined by independent auditors under SOC 2 Type II. We publish the status plainly, because that is what we would want from a vendor.
Request documentation under NDAAutoReveals runs on infrastructure providers that each hold a current SOC 2 Type II report across the Security, Availability, and Confidentiality trust criteria. From the database to the edge, your data sits inside independently examined environments.
- Hosting, database, and delivery layers each SOC 2 Type II audited
- Provider reports available under NDA through the security packet
- Coverage reviewed at every renewal
The controls behind the product are checked by people who do not work here, on a schedule, with the evidence kept.
- Continuous control monitoring, evidence collected automatically
- Annual third party penetration test
- Vendor risk reviews for every subprocessor
Controls you can point to.
The short version of what your IT lead will ask about. The long version is in the security packet.
TLS 1.2 or higher for every connection. AES 256 for data at rest, including backups and browser sessions.
Owner and buyer roles are enforced server side. Buyers see their own work; money actions go up for verdict.
Single sign on through your identity provider on Enterprise plans. MFA is available to every account.
Every Saif action is logged with who asked, what ran, and a screenshot of each step in a connected tool.
Bids, purchases, payments, and signatures stop at a one shot confirm that names the exact action and amount.
Each store’s data and browser profiles are isolated. No shared sessions, no cross store queries.
Export any time. Deletion on request, completed within 30 days and confirmed in writing.
A tested response plan, customer notification within 72 hours of a confirmed incident, and a public disclosure address.
Security is a habit, not a page.
Every engineer is background checked and trained on secure development before touching production. Access is least privilege, reviewed quarterly, and removed the day someone leaves.
Send this page to your IT lead.
Then ask us for the packet. SOC 2 documentation, policies, pen test summary, and the subprocessor list, under NDA within one business day.