Flipdesk
FeaturesHow it worksPricingBlogHelp
Log inGet started
Security

Built to keep your business data safe.

Your stock, sales and connected accounts are the heart of your business. Here's exactly how Flipdesk protects them.

1.At a glance

Passwords never storedOnly a salted one-way hash is kept, so nobody can read your password.
Encrypted connectionsInbox app passwords and eBay tokens are encrypted, with the key kept apart from the database.
Private by designEvery record belongs to one account, and every request checks it's yours.
HTTPS everywhereEvery page and connection is encrypted in transit, with strict browser protections.
Official connectionseBay connects through eBay's own sign-in. We never see your eBay password.
No trackersNo advertising or analytics scripts. Nothing on Flipdesk follows you around the web.

2.Your password

  • Stored only as a PBKDF2-SHA256 hash with a unique random salt for every account. Even we can't see it.
  • Password reset links work once and expire after an hour. Only a hash of the link is stored.
  • Changing your password logs you out on every other device.

3.Signing in

  • After 5 wrong passwords, an account is locked for 15 minutes. Repeated attempts from one connection are blocked too.
  • The same login error is shown whether or not an account exists, so the form can't be used to find out who uses Flipdesk.
  • You stay signed in with a signed, secure, http-only cookie that scripts can't read. It expires after 30 days.
  • Log out everywhere in Settings ends every session at once.

4.Inboxes and eBay

  • Inboxes connect with an app password, never your main email password. You can revoke it with your email provider at any time, and Flipdesk stops immediately.
  • eBay connects through eBay's own sign-in page using OAuth. Flipdesk receives a token that only lets it read your orders, fees, payouts and messages. It can't change your listings or your account.
  • App passwords, tokens and API keys are encrypted with AES-256-GCM. The encryption key is held separately from the database, so a copy of the database alone reveals nothing.
  • Disconnect any inbox or eBay in Settings whenever you like.

5.Your data stays yours

  • Every record is tied to your account, and every page and action checks that it belongs to you before showing or changing it.
  • The people who run Flipdesk can see account details needed for support (such as your email address and plan). They can't see your password or your connected-account passwords.
  • You can export everything as CSV, or delete your data or account, from Settings.

6.On the web

  • HTTPS only, with HSTS so browsers never fall back to an unencrypted connection.
  • A strict Content Security Policy, plus protection against clickjacking and content sniffing.
  • No third-party advertising or analytics scripts.

7.Hosting and payments

  • Flipdesk runs on Cloudflare's global network, which includes protection against denial-of-service attacks.
  • When card payments go live, card details are entered on our payment provider's secure page and never touch Flipdesk's servers.

8.What you can do

  • Use a password you don't use anywhere else.
  • Use app passwords for inboxes, and remove any you no longer use.
  • Log out everywhere if you've used a shared or lost device.

9.Reporting a security issue

Found something that doesn't look right? Email support@flip-desk.app with the details. Please give us a chance to fix it before sharing it publicly. We'll reply quickly and keep you updated.

This page explains how Flipdesk works in plain English. It isn't legal advice. If anything here is unclear, contact us.