Security principles
- Least privilege: users and integrations receive only the access required for their function.
- Per-seller authorization: each Amazon seller connects their own account through Login with Amazon authorization.
- Server-side secrets: application credentials and encryption keys are held in managed runtime secrets, not source code or browser storage.
- Data minimization: EcomSeller does not request restricted SP-API buyer-PII roles for its sourcing workflow.
Access control
Workspace access is authenticated and role-based. Administrative functions are limited to designated administrators, and seller tokens are scoped to the authorizing workspace. Access should be reviewed when duties change and removed promptly when a user leaves.
Encryption and credential handling
Production traffic is encrypted in transit using HTTPS/TLS. Amazon authorization tokens and integration secrets are encrypted before persistence. Secrets are never committed to public repositories, shared in team chat, or hard coded into the application.
Application and network protection
The service uses managed network-edge protections, request isolation, encrypted connections, dependency controls, access logging, and application-layer validation. Production and development credentials are kept separate.
Incident response
Suspected incidents are triaged by a designated incident owner, contained, investigated, documented, and followed by corrective action. Incidents involving Amazon Information are reported to Amazon at security@amazon.com within 24 hours of detection, consistent with Amazon requirements. The incident procedure and contact roster are reviewed at least every six months.
Responsible disclosure
If you believe you found a security issue, do not access or alter data that is not yours. Send a clear description and reproduction steps to support@ecomseller.co. We will acknowledge and investigate good-faith reports.