Amazon SP-API Data Protection & Handling Policy
Regton Ltd - Internal Application “ShipOS” - Effective February 2025, Last Revised March 2026
1. Data Collection
Amazon Information is retrieved exclusively via direct SP-API endpoint calls. The specific API operations used are:
- Orders API – to retrieve order identifiers and shipment details.
- Merchant Fulfillment API – GetEligibleShipmentServices (rate queries) and CreateShipment (label generation).
No third-party aggregators, middleware platforms, or external data providers are used to retrieve or relay Amazon Information. Our application connects directly to Amazon SP-API endpoints using encrypted HTTPS (TLS 1.2+) connections authenticated via Login with Amazon (LWA) OAuth tokens.
2. Data Processing
PII is processed within the ShipOS application solely for the purpose of generating shipping labels via the Amazon Buy Shipping programme. Processing occurs on dedicated, encrypted workstations within our warehouse environment. Specifically:
- Buyer name, address, and phone number are passed as required parameters to the GetEligibleShipmentServices and CreateShipment operations.
- PII is held in application memory during the label generation workflow and is not written to temporary files or unencrypted caches.
- No automated profiling, analytics, or secondary processing of Amazon buyer data takes place.
3. Data Storage
Encryption at Rest
All systems handling Amazon Information employ full-disk encryption using AES-256. Encryption keys are managed through AWS Key Management Service (AWS KMS) with automatic annual key rotation. SP-API credentials (LWA client secrets, refresh tokens) are stored in encrypted environment variables managed by a secure secrets manager and are never committed to version control repositories.
Database Storage
Order data containing PII is stored in a local MySQL database instance accessible only from localhost. The database resides on an AES-256 encrypted volume. Remote access to the database is disabled; connections are restricted to the ShipOS application server only.
4. Data Usage
Amazon Information is used strictly and exclusively for order fulfillment operations:
- Retrieving eligible shipping rates from Amazon Buy Shipping.
- Generating shipping labels with carrier-compliant recipient details.
- Confirming shipments and uploading tracking numbers to Amazon.
Amazon data is never used for marketing, advertising, customer profiling, market research, resale, or any purpose beyond the fulfilment of the specific order to which it relates.
5. Data Sharing
PII is shared only with the following authorised logistics carriers for the sole purpose of physical delivery:
| Carrier | Data Shared | Method |
|---|---|---|
| Royal Mail | Recipient name, address | Encrypted API (HTTPS/TLS 1.2+) |
| DPD | Recipient name, address, phone | Encrypted API (HTTPS/TLS 1.2+) |
| TNT | Recipient name, address | Encrypted API (HTTPS/TLS 1.2+) |
| DX | Recipient name, address | Encrypted API (HTTPS/TLS 1.2+) |
| Amazon Shipping | Recipient name, address | Encrypted API (HTTPS/TLS 1.2+) |
No other third parties, data processors, sub-processors, or analytics providers receive Amazon Information. Data is never sold, licensed, or disclosed for non-fulfilment purposes.
6. Data Retention & Disposal
Retention period: PII is retained for a maximum of 30 days following order fulfilment.
Disposal method: After the retention period, PII is permanently purged from production databases using secure deletion (overwrite). Automated scheduled tasks enforce this policy without manual intervention.
Backups: Encrypted backups (AES-256) are stored in a geographically separated AWS S3 environment with server-side encryption. PII within backups is purged within 30 days of original collection. Recovery Time Objective (RTO): <8 hours. Recovery Point Objective (RPO): <24 hours. Restore procedures are tested quarterly.
No long-term PII archives are maintained beyond the 30-day operational window.
7. Access Control
- Access is granted on a need-to-know basis following the Principle of Least Privilege (PoLP).
- Every employee is assigned a unique user account. Shared or generic accounts are strictly prohibited.
- Access to Amazon Information is restricted to shipping department personnel and management only.
- Access rights are reviewed quarterly and revoked within 24 hours of employment termination.
- Multi-Factor Authentication (MFA) is mandatory for all accounts accessing systems that handle Amazon data.
- Password policy: minimum 12 characters; at least one upper-case letter, one lower-case letter, one number, and one special character; must not contain any part of the user’s name; 1-day minimum age; 365-day maximum expiration; reuse of the last 12 passwords is prohibited.
- Account lockout after 5 consecutive failed login attempts.
8. Logging & Monitoring
We operate a centralised logging and monitoring system using the ELK Stack (Elasticsearch, Logstash, Kibana). All authentication events, SP-API data access requests, label generation events, and system errors are recorded.
Monitoring Mechanism
Automated alerting rules in Kibana monitor for: multiple failed login attempts (threshold: 5 in 10 minutes), unusual API request volumes exceeding baseline by over 200%, access from unrecognised IP addresses, and any attempt to export data outside approved workflows. Alerts are delivered to the IT administrator in real time for immediate investigation.
PII in Logs
Our logging configuration excludes PII from all log entries. Logs record event metadata only: timestamps, user IDs, API operation names, HTTP response codes, and source IP addresses. Buyer names, addresses, and phone numbers are never written to log storage. This exclusion is enforced at the application logging layer through field-level filtering.
Log Retention
Security and audit logs are retained for a minimum of 12 months in encrypted storage with restricted access. Logs are reviewed bi-weekly for anomalies.
9. Incident Response
Our Incident Response Plan follows the NIST Computer Security Incident Handling framework:
- Identification – Detect the breach via monitoring alerts or employee reporting.
- Containment – Isolate affected systems from the network immediately.
- Eradication – Remove the threat vector (malware, compromised credentials, vulnerability).
- Recovery – Restore from verified clean backups; validate system integrity before reconnection.
- Notification – Report the incident to security@amazon.com within 24 hours of detection, and notify any affected parties as required by applicable law.
- Lessons Learned – Conduct a post-incident review and update policies and controls accordingly.
The plan is reviewed every six months and approved by senior management. The Incident Management Point of Contact (IMPOC) is: Marcus Ingram, admin@regton.com.
10. Vulnerability Management
Vulnerability scans are conducted at least every 180 days. Penetration tests are conducted annually. Application code is scanned for vulnerabilities prior to each release using static analysis tools (SonarQube, Snyk). Critical vulnerabilities are remediated within 7 days; high-severity within 30 days.
11. Network Protection
Our infrastructure employs a defence-in-depth approach: perimeter hardware firewalls, network access control lists blocking unauthorised IPs, endpoint anti-malware with real-time scanning, and VPN-only access for remote administration. USB mass storage devices are disabled on all workstations handling Amazon data. Public access to databases, file servers, and internal endpoints is disabled.
12. Testing & Development
All development and QA environments use anonymised, synthetic, or mock data only. Real Amazon buyer PII is never used in testing. Application changes are validated in a dedicated staging environment before deployment to production.