Security overview

• Reporting window and channel: For a security incident involving Amazon data, we report it to Amazon within 24 hours of becoming aware of it, and provide the scope we know and the progress of our response. On the Selling Partner API side the report goes to Amazon's designated security mailbox, security@amazon.com; advertising-side incidents go through the Amazon Ads Partner Network support channel.
• Not notifying on Amazon's behalf: Unless Amazon asks us in writing, we do not notify regulators or customers on their behalf, and we do not describe Amazon's handling decisions publicly.
• Review cadence: The incident response plan is reviewed at least every six months, after which the procedure is updated, exercised and the record kept. Access permissions are reviewed at least quarterly.
• Evidence: We keep records of the detection, containment, investigation, reporting and remediation of every incident, including timestamps, the people involved, API responses and external communications, for no shorter than the deletion schedule in our privacy policy.

Remaining obligations under the data protection and acceptable use policies

In addition to the incident response requirements above, we meet the following obligations under Amazon's Data Protection Policy (DPP) and Acceptable Use Policy (AUP). These are practices we actually carry out, not declaratory clauses.

• Risk assessment reviewed by management every year: We perform a formal assessment of data security risks once a year. The results go to management for review and the conclusions are recorded. If the review points to new controls, those enter that year's remediation plan.
• Named incident management contact: Security incident enquiries are handled by secure@qiwangkj.com, which the engineering team processes directly rather than through general support. When we report a security incident to Amazon, we submit it in the company's name, not an individual's.
• Data deletion method: Deletion follows the methods in NIST SP 800-88. Media holding the data receive unrecoverable treatment rather than a logical delete alone. Where Amazon requires written certification of destruction, we provide it.
• Data attribution is clear and traceable: Data from Amazon is held in a separate data store and is not mixed with our own business data. Every record carries a source identifier so it can be traced back by origin when needed.
• Deletion deadline: When Amazon gives notice requiring deletion, you revoke authorisation, we determine on our own initiative that we are no longer entitled to access the data, or our participation in the services ends, whichever happens first, we permanently and securely delete the information within 30 days, including any live online instances.
• Records kept for 12 months after the agreement ends: Operational records related to the processing of Amazon data are retained for 12 months after the agreement terminates. Where Amazon asks us to certify compliance in writing, we provide that written certification.
• Subprocessors assessed annually: We conduct a risk assessment of the subprocessors involved in data processing once a year, covering whether their security measures and policies are as strict as our own. The outcome determines whether we continue working with them.
• Access disabled within 24 hours of a personnel change: Accounts for employees, contractors and other third parties are disabled or removed within 24 hours of a departure, contract termination or role change, and no longer carry any access to Amazon data. Service accounts and programmatic credentials that are no longer needed, or where compromise is suspected, are revoked immediately.
• Annual data protection and security training: Everyone with access to Amazon data (employees, contractors and third parties) completes data protection and IT security awareness training at least once a year. New joiners complete it before they first touch that data.
• Vulnerability scanning and penetration testing: We scan the production environment for vulnerabilities every 30 days, add a scan after any significant change, and run a static code scan on every release before it ships. Penetration testing happens at least once a year, carried out by an external team using an industry-recognised methodology, covering network boundaries, cloud environments, application-layer interfaces and storage systems. Findings enter the remediation plan and are tracked to closure.
• Organisational changes notified within 30 days: If a merger, acquisition, transfer of business ownership, or a material change in the scope of our products and services occurs, we notify Amazon within 30 days. On the Selling Partner API side that notification is submitted through Amazon SP-API Solution Provider Support (developer.amazonservices.com/support). We maintain a written policy for this.
• Disclosing related entities when applying for additional roles: If we later apply for new API roles, we disclose to Amazon the related entities involved in the application or the service.
• Suspected user violations: If we suspect that an authorised user is using our service in breach of their agreement with Amazon, we notify Amazon (by email to spapi-abuse@amazon.com) and block that user's access to our application.
• No publication of Amazon business insights: We do not publicise, publish or share insights about Amazon's business, and we do not use such insights for our own business purposes. Competitor advertising intelligence is used only for private analysis within the customer's own account.
• No cross-seller data aggregation: We do not aggregate data from different authorised users and provide it to any party, including other sellers. Cross-site analysis happens only across multiple sites belonging to the same seller.
• Impact of new features assessed before release: Before a new feature is enabled for customers, we first verify its real effect on the advertising account in read-only mode. For business-critical features that touch budgets and bids, we roll out to a small group first and confirm the impact is acceptable before widening it. If we find a negative impact, we prioritise the rollback and kill switch over shipping it.
• Scope of buyer personal information: The additional requirements that the Amazon data protection policy sets for buyer personal information (PII) apply only where an interface returns PII or combines PII with other data. We request no role that returns buyer personal information and we do not request a Restricted Data Token, so that group of requirements does not apply to us. Even so, on encryption at rest, log retention, subprocessor management and asset control we hold ourselves to the same standard or stricter.