PrepVia: How I Built a Multi-Marketplace Platform Alone

What is PrepVia

PrepVia is a shipping and product prep platform for online sellers on Amazon (FBA and FBM), eBay, and Shopify. I built the whole thing by myself: frontend, backend, marketplace connections, security, and cloud setup.

Here's how big it is:

How It's Built

PrepVia is a pnpm monorepo with two apps:

The frontend uses Next.js 15 with React 19, Tailwind CSS, shadcn/ui, Zustand for state, and TanStack React Table for data tables.

The backend uses Express 5 with tRPC 11 for type safety, Prisma ORM, and MongoDB Atlas.

I set up 4 levels of access in tRPC:

1. publicProcedure for pages that don't need login
2. protectedProcedure needs login and finished onboarding
3. adminProtectedProcedure needs admin role + 2FA checked + MFA set up
4. amazonProcedure admin-only with full logging for Amazon data

Every request goes through: Sentry tracking, XSS cleaning, session check, then role-based access check.

Network Setup

Traffic comes through Cloudflare (DNS, CDN, DDoS, WAF), then CloudFront for caching, into a private EC2 server. MongoDB Atlas is the database, S3 stores files, SQS handles background work, and SES sends emails.

Marketplace Connections

Amazon SP-API

This was the hardest part of the project. Here's what I built:

Login works through Amazon's OAuth 2.0 system, and tokens are encrypted with AES-256-GCM in AWS KMS/SSM. Orders sync every 15 minutes using EventBridge + Lambda. There's also a separate job for FBM (Fulfilled by Merchant) orders.

The key design choice: buyer personal data (email, address, phone) never gets saved to the database. It gets removed in memory before any save. Everything gets deleted within 20 days.

Amazon data is kept in its own models (AmazonAccount, AmazonOrder, AmazonOrderItem) with marketplace and region tags to keep it separate.

How Data Moves (No Personal Data Saved)

1. OAuth 2.0 login with Amazon, token encrypted in SSM/KMS, saved in MongoDB
2. EventBridge runs every 15 min, gets data from SP-API, personal info removed in memory, only order info saved
3. Seller dashboard needs MFA + role check, shows only non-personal data, no export allowed
4. Live monitoring with 1-hour check and 24-hour Amazon report window
5. Daily auto-delete job + 12-month logs that can't be changed

eBay and Shopify

Both have their own login flows, order sync, and webhook handlers. Same security rules as Amazon.

Main Features

Inventory and ASIN Tracking. Full stock tracking with profit calculator for each ASIN. Sellers can manage products, track costs, and see profits across all marketplaces.

Pallet Builder. Visual tool for building FBA shipments. Calculate size, weight, and shipping costs.

Stripe Billing. Subscription plans, invoices, payments, and webhook handlers for billing events.

QuickBooks Sync. Auto invoice creation and money reports synced to QuickBooks.

HubSpot CRM. Contact management and meeting booking. A background job checks for meeting updates.

Training System. Seller training with courses, certificates, and progress tracking.

Referral Program. Commission tracking, payouts, and admin controls.

AI Data Pipeline. Sellers upload CSVs or documents. They go into an SQS queue, and a background worker uses OpenRouter AI and Tesseract OCR to read and pull out data.

Security

This is the part I'm most proud of. PrepVia meets Amazon SP-API Data Protection Policy (DPP) rules.

Security Test Results

An outside security test was done by CyberSecurityArm (OSCP+/CEH certified) on March 2, 2026.

They found 8 problems:

I fixed all 8 in 24 hours. A second test on March 12 found zero problems.

The biggest one was a High-level IDOR (CVSS 8.2): a normal user could see admin reports and other users' data by changing the ID in the URL. I fixed it by adding owner checks and role checks in the tRPC code.

The server test result was INFORMATIVE (the best result possible). Zero serious problems. Only port 443 (HTTPS) was open, everything else was closed. No SSH, RDP, FTP, or database ports open to the internet.

Custom Security Tools

I built two Node.js services from zero for live threat finding and auto response.

DetectionService

Watches all requests for SQL injection tries, login attacks, mass data downloads, and data leak patterns.

SecurityResponseService

When DetectionService finds a problem, this service right away blocks the IP and/or user account, stops hacked accounts, creates a SecurityIncident record that can't be changed, and starts the 1-hour check to 24-hour Amazon report process.

Security Dashboard

Live monitoring showing active threats, blocked users/IPs, event timeline, system health, and logs.

Layers of Protection

App level: XSS cleaning runs on every tRPC request, removing HTML/script tags before the router sees them. Zod checks all inputs. React's built-in protection handles the frontend. Every user query checks if that user owns the data.

Login and sessions: better-auth handles login. Admins must set up MFA with TOTP.

Sessions end after 8 hours with a 15-minute sliding window. Cookies are Secure, HttpOnly, SameSite=Lax. Passwords must change every 90 days and you can't reuse old ones.

WAF: Two layers. Cloudflare Pro (OWASP rules, custom WAF rules, min TLS 1.2, HSTS 6 months) and AWS WAF (SQLi/XSS/rate limiting).

Auto Security Scanning

I set up auto scanning with AWS Lambda + EventBridge that runs on a schedule. No manual work needed.

EventBridge calls a Lambda that clones the repo, runs Semgrep for code scanning and OWASP ZAP for live app scanning.

Semgrep results: 255 rules, 498 files checked, zero findings.

OWASP ZAP results: 60 checks passed, zero failures. Covers XSS, CSRF, cookie safety, clickjacking, info leaks, and session handling.

Dependency check: pnpm audit shows clean on both main and staging.

Dependabot: 0 open, 30 closed. All fixed.

Breach check: DeHashed and Have I Been Pwned both show zero leaks for prepvia.com. Three email addresses being watched.

Auto PII Deletion

A custom startPiiDeletionCron() runs every hour in production. It deletes old personal records, rotates old KMS keys, and works in batches. First run is 30 seconds after server starts, then every hour.

This makes sure buyer personal data (email, address, phone) never stays past 20 days.

Encryption

Data moving between servers: TLS 1.2+ everywhere (A/A+ grade on Qualys SSL Labs). Data sitting in storage: AES-256-GCM on all databases (MongoDB Atlas EBS + S3 server-side encryption). Secrets are in AWS KMS + SSM Parameter Store with yearly key change.

AWS Setup

The $66.69/month Stack

IAM

2 IAM users, 22 roles. MFA on root and all users. Access reviews happen in regular security meetings.

Backups

Daily full backups plus hourly small ones (02:00 to 04:00 UTC). Kept for 30 days (daily), 90 days (weekly), 12 months (monthly), 7 years (yearly). Restore test once a year. Keys stored separately from backups.

Monitoring

A custom service checks cloud resources against the CIS AWS rules. Alerts on config changes get auto-handled and logged.

Network

Private VPC with 3 zones (us-east-2a, 2b, 2c), route tables, internet gateway, and NAT. The EC2 server is not open to the internet directly.

CI/CD with No AWS Keys

No AWS keys stored in GitHub. Deploys use OIDC between GitHub Actions and AWS.

The deploy role only trusts certain branches: main, staging, pull requests, and manual runs. No long-lived keys anywhere in CI/CD.

Amazon SP-API Approval

PrepVia passed the Amazon SP-API Developer Security Questionnaire (PRE.2.1) with full proof. Here's what they checked:

• Data flow: full diagrams showing no personal data is stored
• Encryption: TLS 1.2+ for data in transit, AES-256-GCM for stored data
• Access control: role-based access + MFA + least access (2 users, 22 IAM roles)
• Data deletion: 20-day auto-delete, follows NIST 800-88 rules
• Logs: 12-month logs that can't be changed, no personal data in logs
• Problem response: 24-hour Amazon report time, custom detection and response tools
• Scanning: daily checks (Dependabot + Inspector) + yearly security test
• WAF: two layers, Cloudflare + AWS WAF with OWASP Top 10 rules
• DLP: AWS Macie scanning S3 for personal data
• Data tracking: Amazon data in its own models with marketplace tags

Background Jobs

Seven jobs start with the server:

1. PII Deletion runs every hour, deletes old personal data, rotates KMS keys
2. Data Pipeline Worker handles the SQS queue for CSV/document uploads with AI reading
3. FBM Order Sync gets Amazon FBM orders on schedule
4. Storage Billing counts inventory storage fees
5. Email Reminders sends scheduled emails via SES
6. Meeting Check looks at HubSpot for meeting updates
7. Invite Cleanup removes expired user invites

Stripe and HubSpot webhooks handle subscription events, payment updates, and CRM changes.

Tech Stack

What I Took Away

1. I built and secured this whole platform alone. That taught me more than any course ever could.
2. You can run serious apps on $67/month if you make good choices.
3. Three marketplaces, six outside APIs, 100+ pages, 58+ models, and it all works together.
4. Passing Amazon's security check made me think about security in a way I never did before.
5. Building DetectionService and SecurityResponseService from zero was the most fun engineering work I've done.
6. The no-personal-data rule was a limit that actually made the whole system better.