Trust
Security
OFTOPUS works inside your Amazon seller and advertising accounts, so protecting your data is part of the product. This page summarizes the controls we run. The full details of how we handle data are in our Privacy Policy.
How we connect to Amazon
- You authorize OFTOPUS on Amazon's own pages through the Selling Partner API and the Amazon Ads API. We never ask for or store your Amazon password.
- We request only the Amazon access our service needs, and no access to Amazon buyer personal information such as names, addresses, emails or phone numbers.
- You can revoke our access at any time in Seller Central, in Amazon Ads, or in your portal.
Encryption
- All traffic to our website, our portal and Amazon's APIs uses HTTPS with TLS 1.2 or higher.
- Data is encrypted at rest with AES-256. Amazon authorization tokens are encrypted a second time with a key kept outside our database, and the key is rotated at least once a year.
Separation and access
- Each client's data is kept separate, and database rules restrict every record to that client's account.
- Only the people who need it to provide your service can reach client data. Every staff account uses multi-factor authentication, and access is reviewed every quarter and removed within 24 hours when it is no longer needed.
- Every access to your data and every change made in your Amazon account is logged, with who or which automated process, when, what and why. Your portal shows this log, and you can export it.
Monitoring and testing
- A web application firewall and bot protection sit in front of our website and portal.
- Security and access logs are kept for 12 months.
- Our systems are scanned for vulnerabilities at least every 30 days. Critical issues are fixed within 7 days and high-risk issues within 30 days.
- An independent penetration test is run at least once every 12 months.
Incidents
If we detect a security incident involving your data, we notify Amazon within 24 hours as Amazon's policies require, notify affected clients without undue delay, and notify authorities where the law requires.
Retention and deletion
When you disconnect, cancel or revoke access, we stop collecting at once and delete your Amazon data within 30 days, then confirm it in writing on request.
AI and your data
Your Amazon data is used only to serve your own account. It is never used to train or improve our engine for other clients, and we use only AI providers whose terms do not allow them to train their models on the data we send.
Report a security issue
Email account@oftopus.com with the subject "Security report". We acknowledge reports within 2 business days and keep you updated until the issue is resolved.