Security
Sellarge protects the accounts, transaction records, documents, business information, and payment flows that make up a wholesale transaction. The platform uses layered controls across authentication, application access, data protection, file security, and transaction integrity.
Account security
Authentication is designed to reduce common account-compromise risks. Session tokens are stored in httpOnly cookies, limiting exposure to client-side scripts, and passwords are hashed using Argon2id.
Unfamiliar device activity can be detected and flagged, while repeated failed authentication attempts are progressively rate-limited to make automated credential attacks harder.
Technical controls: HttpOnly cookies · Argon2id password hashing · device signals · progressive login rate limiting
Data & document security
Deal records and uploaded documents are protected by access controls. Files are scanned before being made available, while private documents are delivered through signed, expiring URLs instead of exposing private files through public URLs.
Sensitive business information is encrypted at rest, including registration information, bank references, and contact details.
Technical controls: encryption at rest · malware/file scanning · signed URLs · expiring access · authorization checks
Transaction integrity
Important transaction events are recorded in an append-only audit log, preserving timestamps, actors, and status changes throughout the transaction.
This means the transaction history isn’t dependent on someone remembering what happened months later.
Technical controls: append-only audit events · timestamps · actor attribution · transaction-state history
API & application security
Requests are validated against strict schemas before being processed. Database queries are parameterized to reduce injection risks, while rate limiting helps protect the platform from automated abuse.
Access to transaction data is enforced server-side rather than relying solely on what the client application displays.
Technical controls: strict schema validation · parameterized queries · server-side authorization · rate limiting · input validation
Auditability
Bronze and above companies can export a structured transaction record and documents containing deal details, e-signed terms & agreements, timestamps, actors, and relevant transaction events.
The resulting record can be used when a transaction needs to be reviewed internally or by authorized legal, financial, or compliance teams.
Exportable audit trail · timestamps · actor history · transaction events · signed transaction records
Payments
Sellarge does not act as a custodian of customer funds.
Payments are processed through Sellarge’s integrated payment infrastructure according to the transaction terms. Funds are settled to the appropriate party, while Sellarge’s transaction fee is settled as part of the payment flow.
There is no manual release process where Sellarge has to decide when a seller receives their funds.