TRUST / SECURITY

Security built into
every workflow.

The shared ERP platform applies the following controls to protect authorized Amazon information.

Network access

Databases, file servers and development endpoints are not publicly accessible. Private networks, firewalls, least-privilege access and authenticated administrative channels restrict access to approved personnel.

Encryption & credentials

Amazon information is encrypted in transit with TLS 1.2 or later and at rest with AES-256. KMS-managed encryption keys and Secrets Manager protect keys and application credentials. Secrets are injected at runtime, excluded from source code and scanned for in repositories and build pipelines. Access is restricted and audited.

Identity & monitoring

Individual accounts use least privilege and MFA. Passwords have at least 12 characters with upper/lowercase letters, numbers and symbols, and a 90-day expiry policy. Suspicious access and data operations generate alerts and investigation records. Security logs exclude buyer PII and secrets, are retained for at least 12 months and are reviewed at least every two weeks.

Safe development & testing

Production buyer PII is excluded from development and test environments. Testing uses synthetic or irreversibly anonymized data. Peer review, dependency and secret scanning, static checks and runtime controls protect releases. Scan every release, at least every 30 days, and following significant changes; conduct penetration tests at least every 365 days.

Remediation & incident response

Findings are tracked with severity, owner, due date and retest evidence. Critical vulnerabilities are remediated within 7 days, high-severity vulnerabilities within 30 days. The incident response plan is reviewed at least every six months. We notify security@amazon.com within 24 hours of discovering an incident involving Amazon information. Security contact: a958965018@gmail.com.

Location, retention & deletion

Market data and backups remain in the corresponding country on Alibaba Cloud; no cross-country backup replication. Shipping buyer PII is deleted no later than 30 days after shipment. Amazon deletion notice, authorization revocation, service termination or loss of processing authority trigger deletion of affected data and copies within 30 days of the earliest event. Legally required fields are isolated and access restricted.