Security & Data Protection

Control statement supporting the SP-API Data Protection Policy questionnaire

This page describes the controls actually implemented by this application. It is reviewed together with the Incident Response Plan every six months.

1. Network protection

The site is reachable only over HTTPS. HTTP is redirected to HTTPS at the hosting edge, and all cookies require a secure transport.
The hosting provider supplies an edge firewall, web application firewall and malware scanning for the shared hosting environment; the application itself is never exposed on an unmanaged port.
The local machine that runs the print agent uses the operating system firewall and is separated from the printer and other devices on a distinct local network segment. It initiates outbound connections only; no inbound port is opened to the internet.
Runtime logs are monitored for repeated authentication failures and unexpected restarts.

2. Access control and least privilege

There is exactly one administrator account. No other person, role or service can view Amazon data through this application.
Administrative access requires a password and a TOTP code from an authenticator application. TOTP codes may be used only once; adjacent clock windows are tolerated but replay is rejected.
Login attempts are limited to five per fixed one-minute window, including successful attempts.
The database uses a dedicated user with access only to this application's own schema. Hosting panel, database, Amazon Seller Central and AWS accounts use separate credentials.
Sessions last at most 8 hours, are invalidated on logout or credential rotation, and all new API routes are placed behind session verification.

3. Encryption in transit

Every request, including the SP-API calls made by the local agent and the agent's communication with this site, uses TLS. The application sets Strict-Transport-Security at the hosting edge, marks the session cookie Secure, and refuses to start with a non-HTTPS application origin.

4. Incident response

A written Incident Response Plan assigns responsibility, defines containment and recovery steps, is reviewed every six months, and requires notification to security@amazon.com within 24 hours of discovery of any security incident involving Amazon information.

5. Password and authentication policy

Length & complexity	Administrator passwords must be at least 16 characters, contain mixed character classes and special characters, and are generated and kept in a password manager.
Storage	Passwords are stored only as a salted scrypt hash (`N=32768, r=8, p=3`, 64-byte derived key). Plaintext passwords never reach the database, logs or source control.
Multi-factor authentication	TOTP (6 digits, 30-second step, SHA-1) is mandatory for every login. The seed is provisioned out of band and stored outside the web root.
Expiry & rotation	Administrator credentials are rotated at least annually and no later than 365 days after issuance, and immediately after any suspected compromise. Rotation also invalidates all existing sessions.

6. Credential storage

No credentials are hardcoded, shared or committed. All secrets (ADMIN_PASSWORD_HASH, ADMIN_TOTP_SECRET, database credentials and the SP-API client identifier, client secret and refresh token) are supplied as environment variables configured in the hosting panel or on the local agent. Secret files are excluded by .gitignore, kept outside the publicly served directory with restricted permissions, and never appear in application code, logs or the repository.

The SP-API refresh token and AWS signing credentials exist only on the local agent machine inside our own network. The public web server holds no Amazon API credentials at all; the agent pushes sanitised product records to it over an authenticated channel.

7. Application-level hardening

Content Security Policy default-src 'none', frame-ancestors 'none', base-uri 'none'; X-Content-Type-Options: nosniff; Referrer-Policy set to avoid leaking URLs; Cache-Control: no-store on authenticated responses.
Cross-site request forgery protection by strict Origin verification on all unsafe methods, with SameSite=Strict cookies.
Session tokens are 256-bit random values; only their SHA-256 hashes are stored, and comparing password hashes uses a constant-time comparison.
Request bodies are size limited; request and header timeouts are bounded; all database access uses parameterised statements.
The public compliance pages contain no scripts, no external assets and no analytics.

8. Data scope

The application holds only our own product, pricing, inventory and aggregate report data. It holds no buyer PII and does not request SP-API roles that would expose it. See About this application and Privacy Policy.

9. Review

These controls are reviewed every six months, after any material change to the application, and after any security incident. Next scheduled review: six months from 2026-11-14.