Amazon SP-API access is pending approval. These principles describe our security approach; Amazon-specific controls and provider access must be verified before the integration is enabled.
Security principles
- Least privilege: users and integrations receive only the access required for their function.
- Per-seller authorization: the planned integration requires each seller to authorize access through Amazon’s authorization workflow.
- Server-side secrets: application credentials and encryption keys are held in managed runtime secrets, not source code or browser storage.
- Data minimization: the sourcing workflow does not require Amazon buyer shipping information.
Access control
Workspace access is authenticated and role-based. Administrative functions are limited to designated administrators, and seller tokens are scoped to the authorizing workspace. Access should be reviewed when duties change and removed promptly when a user leaves.
Encryption and credential handling
Production traffic is encrypted in transit using HTTPS/TLS. Amazon authorization tokens and integration secrets are encrypted before persistence. Secrets are never committed to public repositories, shared in team chat, or hard coded into the application.
Application and network protection
The service uses managed network-edge protections, request isolation, encrypted connections, dependency controls, access logging, and application-layer validation. Production and development credentials are kept separate.
Incident response
Suspected incidents are triaged by a designated incident owner, contained, investigated, documented, and followed by corrective action. Our incident policy requires reporting incidents involving Amazon Information to Amazon at security@amazon.com within 24 hours of detection, consistent with Amazon requirements. The incident procedure and contact roster must be reviewed at least every six months.
Responsible disclosure
If you believe you found a security issue, do not access or alter data that is not yours. Send a clear description and reproduction steps to support@ecomseller.co. We will acknowledge and investigate good-faith reports.