Shipped: encrypted session storage for returns data security

Encrypted session storage is a security update at areturnz that encrypts the data held in a user's active dashboard session, including auth tokens and cached evidence references, so that nothing sensitive sits in plain text on the client or in transit between the session store and our services. It shipped quietly, the way most infrastructure hardening does, but it closes a gap that matters more as the evidence bundles we store get richer and more widely shared across partners, brands, and retailers.

If you run a returns program, the data in your areturnz dashboard is not abstract. It is photos of the item, the opened parcel, the outer label, and the defect. It is grading decisions tied to a confidence score. It is a chain-of-custody record for every one of the 180K+ returns we have processed through facility NJ-01 in East Hanover, New Jersey. Session storage is one of the places that data touches on its way from our servers to a human looking at a screen, and it is exactly the kind of unglamorous layer that security audits care about.

What actually changed

Before this release, session data (auth state, short-lived tokens, some cached dashboard views) was stored using standard practices but without encryption at the storage layer itself. That is common, and it is not inherently unsafe if the surrounding infrastructure is locked down. But it is one more assumption to defend in an audit, and one more thing a partner's security team will ask about before they let us touch their returns data.

With this update, session storage is encrypted at rest using envelope encryption, and session tokens are rotated on a shorter cycle. The practical result is that even if a session store were somehow exposed, the data inside it would not be readable without the separate key material. None of this changes how the dashboard looks or feels. It changes what happens underneath it.

Why this matters for evidence, not just logins

Most security changelogs read like they belong to a different product than the one customers actually use. This one is different because of what sits behind a session: access to the evidence bundle for every return we touch. Each parcel at areturnz gets photographed at receiving (outer label, opened parcel, item, defect), graded A, B, C, or R by an AI model running at about 99.6% match accuracy against operator review, and routed to a disposition with the override history logged. That whole record is available in the dashboard and via a signed-JSON API with webhooks. A session is the door to all of it.

Encrypting that session layer is not a dramatic feature. It will not show up in a sales deck as a headline. But it is the kind of control that partners doing vendor security reviews actually check for, and it fits the same logic behind our chain of custody audit trail work: proof only matters if the system holding it is trustworthy end to end, not just at the moment a photo gets taken.

How it fits the broader security posture

This release sits alongside other changes we have shipped around access control and data handling, including granular API keys for partner integrations and multi-tenant isolation for partners reselling the network under their own brand. The pattern across all of them is the same: tighten the boundary around evidence and operational data without adding friction for the people who need to use it every day. A buyer or claims team pulling a dispute-ready file should never notice the security work happening underneath. They should just get the file, with a photo trail and a timestamp that holds up.

For teams thinking about how long that evidence should live and who should be able to see it, our post on returns evidence data retention and privacy covers the policy side of the same question this update addresses on the infrastructure side.

What to check if you rely on the API or webhooks

For most dashboard users, there is nothing to do. Sessions refresh automatically and the change is invisible day to day. For partners integrating against our signed-JSON API or consuming webhook events, session behavior for the dashboard is separate from API key authentication, so existing integrations are unaffected. If your security or compliance team wants documentation of the change for a vendor review, that is a reasonable ask and one we can support directly.

This is one more entry in a changelog that has included photo evidence on every parcel, real-time ops notifications on the receiving line, and package lookup across the network. You can see the full run of releases on the product updates hub, which is a useful place to check before assuming a feature or security control does not exist yet.

Frequently asked questions

Does encrypted session storage change how I log in or use the dashboard?

No. The change is at the infrastructure layer. Login flow, dashboard navigation, and API behavior are unchanged. The only difference is that session data sitting in storage is now encrypted at rest with a shorter token rotation cycle.

Does this affect the evidence bundles themselves, or just login sessions?

This specific update covers session storage, not the evidence bundle storage itself, which already runs under its own access controls and retention policy. The two are related in that a session is how a user accesses evidence, so hardening the session layer reduces risk around that access path. Details on photos, chain of custody, and disposition evidence sit in our evidence sample, which shows the structure of a real evidence bundle.

Why does a returns processor need this level of security detail?

Because the dashboard and API hold sensitive operational data for every return across 180K+ parcels processed, including photo evidence, grading decisions, and disposition history. Retailers, brands, and partners doing vendor due diligence expect this kind of control, and it is part of what lets areturnz operate as infrastructure other companies build on rather than a tool they have to babysit.

Does this change pricing or require a plan upgrade?

No. Security hardening like this ships to all customers on the network at no additional cost. You can see current plans and what is included on the pricing page.

Where can I see what else has shipped recently?

The product updates hub lists every release, including granular API keys, real-time notifications, and package lookup, alongside this one.

If your security or procurement team needs more detail on how areturnz handles session data, evidence storage, or access control, get in touch and we will walk through it directly.