1. Purpose

This Amazon SP-API Data Protection & Security Policy explains how JMA Creative Solutions Ltd handles Amazon Information when providing Amazon Marketplace Fulfilment Integration and related Amazon Selling Partner API services.

This policy applies to Amazon seller data, Amazon order data, customer delivery data, product/listing data, inventory data, fulfilment data, carrier/tracking data, SP-API credentials, refresh tokens, logs, backups and other Amazon Information processed through seller-authorised integrations.

JMA Creative Solutions Ltd processes Amazon Information only for authorised seller operations and only where a seller has approved or connected the relevant Amazon account to the integration.

2. Service Overview

JMA Creative Solutions Ltd provides a paid custom Amazon marketplace integration service for Amazon sellers.

The service can connect Amazon Seller Central with a seller’s internal ecommerce, warehouse, stock and fulfilment systems. Supported functions may include Amazon FBM order import, scheduled order synchronisation, warehouse fulfilment workflows, carrier label workflow integration, dispatch and tracking upload to Amazon, Amazon listing management, seller-fulfilled stock synchronisation, FBA inventory visibility, SKU mapping and multi-marketplace support.

Each seller must explicitly authorise the JMA application before JMA Creative Solutions Ltd can access that seller’s Amazon account.

3. Deployment Model

JMA Marketplace Fulfilment Integration may be deployed as a customer-hosted integration module, a JMA-managed hosted integration, or as part of a future SaaS platform.

Where the integration is customer-hosted, Amazon Information may be stored in the authorising seller’s own WordPress, WooCommerce, or fulfilment system and hosting environment.

Where the integration is JMA-hosted or provided through a SaaS platform, Amazon Information may be stored in JMA-controlled hosting environments and is protected by the encryption, access control, backup, logging, vulnerability management, incident response and retention controls described in this policy.

In all deployment models, Amazon Information is processed only for seller-authorised operations and access is restricted to authorised users, systems and support processes.

For systems handling restricted marketplace/customer PII or API credentials, JMA’s intended security model is to protect sensitive data using application-level encryption before database storage, with decryption only for authorised workflows such as fulfilment, label creation, returns, refunds, support, troubleshooting or incident response.

4. Amazon Information Processed

Depending on the seller’s authorised integration scope, JMA may process the following categories of Amazon Information:

• Seller account identifiers
• Marketplace identifiers
• Amazon order IDs
• Order status and fulfilment status
• Seller SKUs and product identifiers
• ASINs and listing data
• Order item details
• Quantity and fulfilment channel information
• FBA inventory visibility
• Seller-fulfilled inventory data
• Shipping service level information
• Carrier and tracking information
• Dispatch status
• Return/refund support information where required
• Recipient name and delivery address for merchant-fulfilled orders
• Phone number where provided by Amazon and required for fulfilment/carrier workflows
• SP-API credentials, refresh tokens and application secrets
• System, application and administrative logs required for support, security and audit

Amazon customer PII is used only where required for authorised seller operations, including order fulfilment, shipping label creation, dispatch confirmation, tracking upload, returns, refunds, customer-service support where required and operational audit.

5. Data Sharing

JMA Creative Solutions Ltd does not sell, rent or use Amazon Information for marketing.

Amazon Information is shared only with the following parties where required for the authorised seller integration:

• The authorising Amazon seller/client
• The seller’s authorised SBA/JMACS fulfilment or integration system
• Contracted hosting and infrastructure providers required to operate the integration
• Carrier, postage, fulfilment or label systems required to create shipping labels, dispatch orders or submit tracking
• Professional advisers or authorities where required by law, regulation or legal obligation

Amazon Information is not shared with unauthorised third parties. Third-party access is limited to the minimum required to provide the authorised integration, fulfilment, hosting, security, support or legal/accounting function.

6. Data Collection and Use

Amazon Information is collected through authorised Amazon SP-API connections and seller-approved integration workflows.

JMA uses Amazon Information only for the following purposes:

• Importing authorised Amazon orders
• Supporting merchant-fulfilled warehouse workflows
• Creating or supporting shipping labels
• Uploading dispatch and tracking confirmation to Amazon
• Managing seller-owned listings
• Synchronising seller-fulfilled inventory
• Importing FBA inventory visibility
• Mapping Amazon Seller SKUs to seller/internal SKUs
• Supporting returns and refunds where required
• Providing technical support and troubleshooting
• Maintaining operational, security and audit records
• Meeting legal, accounting or compliance obligations

JMA does not use Amazon Information for marketing, advertising, profiling unrelated to the seller-authorised integration, resale or unauthorised analytics.

7. Network Protection

Production databases and file storage are not intentionally exposed to the public internet.

Public access is limited to approved website and application endpoints. Administrative, database, file server and hosting access is restricted through the following controls:

• HTTPS/TLS for web and administrative access
• Hosting firewall controls
• Web application firewall or equivalent protection for internet-facing systems
• Restricted control-panel access
• Restricted SSH/SFTP access where used
• Server-side permissions and least-privilege file access
• Authenticated administrator accounts
• Role-based access controls
• Strong passwords and MFA where supported
• Anti-malware/security tooling on administrator and developer devices
• No public database access from unauthorised networks
• No public repository storage of credentials, customer data or Amazon Information

Databases, server files and backups containing Amazon Information are accessible only to authorised administrators, infrastructure services and application processes with a legitimate operational need.

8. Access Management and Least Privilege

Amazon Information access is assigned to named user accounts only. Shared logins are avoided.

Access is granted based on job role and business need. Users receive only the minimum access required to perform their duties, such as authorised development, support, fulfilment, technical administration or incident response.

JMA applies the following access-management controls:

• Named accounts for staff and administrators
• Role-based permissions
• Need-to-know access to Amazon Information
• Restricted administrator access
• Removal or disabling of access when no longer required
• Access review when staff roles change
• Restricted access to credentials and refresh tokens
• Separate controls for production, development and support activities where applicable

Warehouse, support or operational users are granted access only to the Amazon Information required for their authorised fulfilment or support task.

9. Asset and Device Management

JMA restricts access to Amazon Information to authorised systems, authorised users and approved devices used for business operations.

Staff and contractors are instructed not to export Amazon Information to:

• USB flash drives
• Personal mobile phones
• Personal email accounts
• Personal cloud storage
• Unauthorised file-sharing platforms
• Public links or public repositories
• Unapproved removable media

JMA monitors access through application, administrative and hosting logs. Suspected unauthorised export, access from unapproved devices, excessive access, suspicious login activity or unusual data access triggers investigation.

If unauthorised device access or data export is suspected, JMA will remove or restrict access, rotate credentials where required, review logs, identify affected Amazon Information and follow the incident response process.

10. Encryption in Transit

Amazon Information is encrypted in transit using HTTPS/TLS.

JMA requires secure transmission for:

• Amazon SP-API calls
• Seller/admin access to web systems
• API communication between authorised systems
• Carrier, label and fulfilment integrations where supported
• Administrative access to systems handling Amazon Information

Unencrypted public transmission of Amazon PII, credentials or refresh tokens is not permitted.

11. Encryption at Rest and Key Management

JMA protects Amazon Information at rest through restricted server/database access, role-based application access, credential controls and application-level encryption for sensitive Amazon Information and credentials where hosting-level storage encryption is not available.

For systems handling Amazon PII or sensitive marketplace credentials, JMA requires sensitive fields to be encrypted before database storage using strong authenticated encryption. JMA’s intended encryption standard is AES-128 or stronger, with AES-256-GCM or libsodium/XChaCha20-Poly1305 preferred where technically available.

Sensitive data that may be encrypted before database storage includes recipient/customer names, billing and shipping address fields, phone numbers, email addresses where stored, customer notes where applicable, raw restricted marketplace payloads, carrier-label payloads containing PII, SP-API refresh tokens, LWA credentials, access tokens where cached, carrier API keys, webhook secrets and other marketplace credentials.

JMA’s controls for Amazon Information at rest include:

• Application-level encryption for restricted PII and sensitive credentials where hosting-level encryption is not available
• Server-side storage only
• Encryption keys stored outside the application database and outside public web files
• Encryption key access restricted to authorised application services and administrators
• Support for key IDs or key versioning where implemented to allow future rotation
• Restricted database and filesystem permissions
• Role-based access controls before restricted PII can be decrypted or viewed
• Decryption only in application memory for authorised workflows
• Masked credential display in administrative interfaces
• No hardcoded credentials in applications
• No credentials committed to public or shared repositories
• No public file storage of Amazon Information, customer PII, tokens or secrets

Where hosting or backup infrastructure stores database content that has not been encrypted by the provider, JMA’s application-level encryption model is intended to ensure that restricted PII and sensitive credentials are stored as ciphertext rather than readable plaintext.

12. Credential and Password Management

Systems handling Amazon Information require strong credential-management controls.

JMA applies the following password and credential practices:

• Named user accounts
• Passwords of at least 12 characters
• Use of special characters and strong password complexity
• MFA where supported
• Annual password rotation for systems handling Amazon Information
• Immediate rotation when compromise is suspected
• Immediate removal or change of access when staff no longer require access
• No sharing of passwords or API secrets through insecure channels
• No credentials stored in public repositories
• No hardcoding of credentials into applications
• No credentials exposed in browser JavaScript or public files
• Secure server-side storage of SP-API refresh tokens, LWA credentials and API secrets

If credential exposure is suspected, affected credentials are revoked or rotated immediately and related logs are reviewed.

13. Backups, Archives and Recovery

Backups containing Amazon Information are stored in restricted-access backup locations separate from the public web root and production application files.

Where restricted Amazon PII or sensitive credentials are stored in the application database, JMA’s security model is to encrypt that sensitive data at application level before database storage so that database backups contain encrypted values rather than readable restricted PII or plaintext credentials.

JMA applies the following backup and recovery controls:

• Restricted administrator access to backups
• Backup storage separate from public website files
• Backups stored outside the public web root
• Application-level encryption of restricted PII and sensitive credentials before database backup
• Encrypted off-site backup storage where required for systems handling restricted Amazon Information
• Geographically separate or provider-separated backup storage where available
• Restoration from recent clean backups where required
• Backup and restore procedures to support operational recovery and incident response
• Periodic restore checks or restore-process reviews for systems handling restricted Amazon Information

JMA’s target recovery objectives for systems handling Amazon Information are:

• Target Recovery Time Objective: within 24 hours for critical operational systems where technically possible
• Target Recovery Point Objective: within 24 hours for critical operational systems where technically possible

If a compromise is suspected, JMA will prioritise restoration from a clean backup, credential rotation, patching of the affected weakness, review of affected Amazon Information and validation before returning systems to normal operation.

14. Data Retention and Disposal

Amazon customer PII is retained only for as long as required for authorised fulfilment, dispatch, returns, refunds, customer-service support, legal/accounting obligations or operational audit.

Where Amazon PII is not required for ongoing authorised purposes, JMA aims to delete, anonymise or archive it within 30 days after fulfilment or delivery, unless a longer retention period is required for legal, tax, accounting, dispute, fraud prevention, return/refund or regulatory purposes.

Temporary raw API payloads and debug data are retained only while required for development, support or troubleshooting and are removed or redacted when no longer required.

Credentials and refresh tokens are disabled or removed when a seller disconnects the integration, revokes authorisation or requests disconnection, subject to any support, legal or audit requirement.

15. Logging and Monitoring

JMA uses system, application and administrative logs to support troubleshooting, access review, security monitoring and incident investigation.

For systems handling Amazon Information, JMA maintains application-level and security logs for relevant administrative, marketplace, fulfilment, credential, import, export, label, support and security events. Where hosting-provider logs have shorter retention periods, JMA uses application/security logs and exported log archives to support longer retention.

Logging and monitoring controls include:

• Logging of administrative access and significant administrative actions
• Logging of marketplace import, sync, fulfilment and credential-management events
• Logging of restricted-data access events where technically implemented
• Logging of application errors and operational events
• Logging of authentication and access-related events where available
• Monitoring for suspicious access, failed access attempts, unusual administrative activity or unauthorised changes
• Review of relevant logs at least bi-weekly for systems handling Amazon Information
• Review of logs after operational or security incidents
• Protection of logs from unauthorised access or modification
• Retention or export/archive of relevant security and audit logs for at least 12 months where Amazon Information is handled
• Avoidance of unnecessary Amazon PII in logs
• Redaction or exclusion of customer PII, credentials, refresh tokens, access tokens, client secrets and raw restricted payloads from logs

Logs are used to investigate suspected unauthorised access, data leakage, credential exposure, configuration changes, marketplace sync errors, suspicious administrative activity and operational anomalies.

16. Vulnerability Management

JMA maintains a vulnerability-management process for systems handling Amazon Information.

This process combines hosting/security controls, WordPress/application security tooling, malware monitoring, vulnerability scanning, code review, release checks and remediation tracking.

Vulnerability-management controls include:

• Vulnerability scanning at least every 30 days for systems handling Amazon Information
• Daily or regular malware/security scanning where available through hosting or security tooling
• Monitoring of WordPress core, plugin and theme vulnerabilities where applicable
• Annual penetration testing for JMA-hosted applications or representative systems handling restricted Amazon Information
• Code vulnerability scanning or security review before release of new code, features or products
• Review and prioritisation of vulnerabilities by severity
• Tracking of findings with owner, affected system, severity, target resolution date, remediation status and closure evidence
• Remediation of critical findings within 7 days
• Remediation of high-risk findings within 30 days
• Verification of remediation before closure
• Controlled release of code fixes and security patches
• Documentation of outstanding findings until resolved

Application changes are evaluated before production deployment. Vulnerabilities identified during development or runtime are reviewed, prioritised, fixed, tested and deployed through controlled updates.

17. Change Management

JMA uses a formal change-management process for systems handling Amazon Information.

The process includes:

• Documenting the requested change
• Reviewing the change purpose and risk
• Testing changes before production deployment
• Restricting production deployment access to authorised users
• Reviewing security impact where Amazon Information may be affected
• Recording deployment actions where appropriate
• Rolling back or remediating changes if issues are identified

Changes affecting Amazon order, listing, inventory, fulfilment, credential, security or logging functionality are reviewed before release.

18. Testing and Protection of PII

Live Amazon PII is not used in testing unless strictly required for authorised troubleshooting or support.

Where testing is required, JMA uses:

• Masked data
• Redacted data
• Synthetic test data where possible
• Restricted-access test environments
• Limited developer/support access
• Reduced or redacted debug logs
• Removal of temporary test data when no longer required

PII is not copied into public test environments, public repositories or unauthorised developer devices.

19. Incident Response

JMA maintains an incident response process for suspected database compromise, unauthorised access, data leakage, malware, credential exposure, unauthorised export of Amazon Information or misuse of Amazon Information.

The incident response process includes:

1. Identify and triage the incident.
2. Restrict affected accounts, systems or access paths.
3. Preserve and review relevant logs.
4. Revoke or rotate affected credentials, tokens and passwords.
5. Identify affected seller accounts, Amazon Information and customer data.
6. Contain the affected system or integration.
7. Patch the weakness or restore affected systems from clean backups.
8. Validate the system before returning it to normal operation.
9. Notify affected parties where required.
10. Notify Amazon at security@amazon.com within 24 hours where Amazon Information is involved and notification is required.
11. Document the incident, root cause, corrective action and prevention steps.
12. Review lessons learned and update controls where required.

The incident response plan is reviewed at least every six months.

20. Seller Authorisation, Disconnection and Revocation

Each seller must explicitly authorise the JMA application before JMA can access that seller’s Amazon account.

A seller can revoke access through Amazon Seller Central or request disconnection from JMA Creative Solutions Ltd.

When a seller disconnects or revokes authorisation:

• API access for that seller is stopped
• Stored refresh tokens are disabled or removed
• Scheduled Amazon API calls for that seller are disabled
• Operational data is retained only where required for support, audit, legal, tax/accounting, return/refund or dispute purposes
• Amazon PII is deleted, anonymised or archived according to the applicable retention process

21. Third-Party Providers and Subprocessors

JMA may use third-party providers only where required to deliver the authorised seller integration, hosting, fulfilment, support, security, backup, monitoring, vulnerability-management or legal/accounting function.

Depending on the seller’s deployment model and selected services, these may include:

• The authorising seller’s own website, hosting and backup providers where the integration is customer-hosted
• JMA’s website, application, server or database hosting providers where the integration is JMA-hosted or provided through a JMA SaaS platform
• Backup providers and encrypted off-site backup storage providers
• Security, malware scanning, vulnerability scanning, monitoring or logging tools
• Courier, postage, carrier or label systems selected by the seller, including Royal Mail, Parcel2Go or equivalent carrier/label services where used
• Professional advisers where required by law, regulation, accounting, legal obligation or business operation

Third-party providers are used only where required for the authorised service. They are not permitted to use Amazon Information for marketing, resale, unrelated analytics or unauthorised third-party purposes.

JMA maintains internal records of relevant subprocessors and third-party services used for systems handling Amazon Information.

22. Data Processing Records

JMA maintains records of Amazon Information processing activities for systems handling Amazon Information.

These records may include:

• Data fields collected
• Purpose of collection
• Storage location
• Users or roles with access
• Sharing or subprocessors involved
• Retention period
• Disposal method
• Security controls applied
• Incident and audit records where relevant

23. Incident Management Point of Contact

For Amazon Information security incidents, the Incident Management Point of Contact is:

Mohammed Alim
JMA Creative Solutions Ltd
Email: dev@jmacreativesolutions.com

General service enquiries can be sent to:

clients@jmacreativesolutions.com

24. Related Pages

Amazon Marketplace Integration & Fulfilment Automation:
https://jmacreativesolutions.com/service/amazon-marketplace-integration/

Privacy Policy:
https://jmacreativesolutions.com/privacy/

Terms:
https://jmacreativesolutions.com/terms/

Contact:
https://jmacreativesolutions.com/contact/