Trust
Security & Data Handling
Store data such as item files, TLOGs, Electronic Journals, and financial reports is sensitive. This page explains how REDList software and REDList engagements treat that data. Where a statement applies only to one product, we name the product. Engagement-specific commitments are confirmed in writing before any production data moves.
How we handle store data across the ELERA Portfolio
The same principles guide migration engagements and the software we build for ELERA stores.
Agree scope before transfer
Before any production data moves, we review scope and data handling with your team, and with your Toshiba partner where one is involved. Commitments for the engagement are put in writing.
Only what the work needs
We ask for the minimum data needed for each phase, typically one representative store for a pilot rather than a whole estate.
Read-only capture
The ACE Onboarding collector reads source files, verifies copies, and creates a checksummed bundle without modifying the ACE store.
ELERA stays authoritative
REDList store software works with ELERA rather than around it. ELERA remains the system of record for users, passwords, roles, lockout, and sessions.
Credentials stay on the server
Where a REDList tool calls ELERA platform services, credentials and platform calls are kept on the server, not in browser code or local storage.
Nothing through this website
Never send production data through a website form or a first email. We will agree a transfer method with you as part of scoping.
Built into the software
Guardrails for production-shaped work
REDList applications are designed so platform-changing actions are deliberate and visible.
- Read-only ACE capture with checksummed evidence (ACE Onboarding)
- Explicit approval before setup is created, and cleanup limited to what a run created (Load Test Console)
- ELERA credentials and platform calls kept on the server, not in browser code or local storage (Load Test Console)
- ELERA remains authoritative for users, passwords, roles, lockout, and sessions (Fingerprint Sign-On)
- TLOG parsing and analysis run locally in the browser (TLOGic)
For security reviewers
If your security or procurement team has a questionnaire or specific requirements, send them to us before scoping and we will answer them for your engagement.
Questions and privacy requests: support@redlistsolutions.com
TLOGic
TLOGic: your transaction data stays on your device
TLOGic, REDList's TLOG analysis application, was designed with privacy as a core principle. The statements in this section describe TLOGic specifically.
Client-side processing
TLOG parsing and analysis run entirely in your web browser using WebAssembly. Calculations and visualizations happen locally on your device.
No upload, no storage
TLOG files are not uploaded to REDList servers during normal use, and REDList does not store, cache, or retain TLOG contents or transaction data. Clearing browser data removes it from your device.
Diagnostics only with consent
If you choose to send a bug report, TLOGic packages selected diagnostics into a ZIP and uploads it only after you review the bundle and consent.
Optional AI, your own key
AI analysis is optional and uses your own API key, kept in your browser and never sent to TLOGic servers. Selected data goes from your browser to the AI provider you choose, and only when you start an analysis.
Limited account data
TLOGic collects only what it needs to run accounts and licenses: email, name if provided, license and subscription status, and support correspondence. Sign-in uses a third-party authentication provider.
Payments handled by Stripe
Subscription payments are processed by Stripe. REDList receives payment confirmation and subscription status and does not store full card numbers.
Personal information
How we treat the information we do hold
- We do not sell, rent, or trade personal information.
- Data in transit is encrypted with TLS, and access to account information is limited (TLOGic).
- Account information is kept only as long as needed to provide the service and meet legal obligations, and is deleted or anonymized when an account is closed, except where the law requires retention (TLOGic).
- You can ask for access to, correction of, or deletion of your personal information by writing to support@redlistsolutions.com.
- REDList services are operated from the United States.
A plain-language note
No method of transmission over the Internet or electronic storage is completely secure. We design our software to keep sensitive store data local or under your control wherever we can, and we tell you plainly when data leaves your environment.
REDList Solutions is a trade name of 4690World, LLC.