Amazon information security · Version 1.0 · 31 August 2026

Secure access.
Defined response.

These controls apply before EmenCore enables production access to Amazon Selling Partner API information.

Identity and access

Every administrator session that can reach Amazon integration controls requires the dedicated EmenCore owner password and multi-factor authentication. Passwords require 12–128 characters, including uppercase and lowercase letters, a number and a special character; expire after no more than 365 days; and cannot reuse the previous 10 passwords. Expired passwords block Amazon access until changed. Access locks after 10 failed password attempts, and repeated MFA failures are also rate-limited and locked. Password recovery requires the authenticated owner identity plus a fresh TOTP code, records an audit event and invalidates all earlier privileged sessions.

Access lifecycle

Only the allowlisted owner can reach Amazon controls. Access is removed within 24 hours of a role change or termination, reviewed quarterly, and limited to the minimum approved SP-API roles. The LWA client secret is rotated at least every 180 days, before Amazon's rotation deadline, and immediately after suspected exposure. Application encryption keys are rotated at least annually and after suspected compromise. Restricted buyer PII is not requested for this integration.

OAuth and token protection

OAuth state is cryptographically random, single-use, server-side validated and expires after 10 minutes. Amazon callback destinations are restricted to HTTPS Amazon-owned authorisation-confirmation paths. OAuth endpoints use Referrer-Policy: no-referrer. Refresh tokens are encrypted at application level using AES-256-GCM, never returned to client code and never written to logs or URLs. Local disconnection cryptographically erases the stored refresh token.

Defined incident roles

The incident plan assigns an Incident Commander and Security Lead, a Technical Response Lead, a Privacy and Legal Lead and a Communications Lead. At activation, a named person is assigned to every role. The team records the discovery time, preserves evidence, contains affected access, investigates scope, rotates or revokes credentials and validates recovery.

Read the complete incident-response plan.

Amazon notification within 24 hours

Any confirmed or suspected incident involving Amazon Information is reported to Amazon at security@amazon.com within 24 hours of discovery. The first notice is not delayed while the investigation is incomplete. It includes the discovery time, known scope, containment performed, point of contact and planned next update.

Review cycle

The incident-response and access-control plans are reviewed at least every six months and after a material incident, Amazon requirement change or significant architecture change. The current review was completed on 31 August 2026; the next scheduled review is no later than 28 February 2027.

Report a concern

Send security reports to statuesworkshop@gmail.com. Do not include passwords, access tokens, refresh tokens or one-time codes in the initial message.