1. Governance
We maintain a written information security policy approved by management and reviewed at least annually.
Our Incident Management Point of Contact can be reached at germbudllc@gmail.com.
We perform a risk assessment at least annually and whenever our systems change significantly.
2. Access control
- Every team member has a unique user account. Shared logins are not permitted.
- Access follows the principle of least privilege.
- Role-based access ensures team members only see data of the sellers they are assigned to.
- Access is removed within 24 hours of a role change or termination.
- Access rights are reviewed quarterly.
3. Authentication
Multi-factor authentication (MFA) is required on all systems that process Amazon Information. Passwords must:
- be at least 12 characters long and include upper- and lower-case letters, numbers and special characters;
- not contain the user's name;
- not reuse any of the last 10 passwords;
- be changed at least every 365 days.
Accounts are locked after 10 consecutive failed login attempts.
4. Encryption
- All data in transit is protected with TLS 1.2 or higher.
- Databases, file storage and backups are encrypted at rest with AES-256.
- API credentials and refresh tokens are stored encrypted in a managed secrets / key management system and never in source code.
- Keys are rotated at least annually, and immediately if compromise is suspected.
5. Network and endpoint protection
- Firewalls and network segmentation are provided by our cloud infrastructure providers and restrict access to production systems.
- All endpoints run anti-malware software with automatic updates that users cannot disable.
6. Logging and monitoring
- Security logs are centralized and protected from tampering.
- Logs are retained for at least 12 months and contain no personally identifiable information.
- Logs are reviewed at least every two weeks.
- Alerts are configured for unusual API activity.
7. Vulnerability management
- Vulnerability scans run at least every 30 days.
- Code is scanned before each release.
- Critical issues are fixed within 7 days and high-risk issues within 30 days.
8. Incident response
We maintain a documented incident response plan with defined roles and responsibilities. The plan is reviewed every 6 months and after major changes.
Security incidents involving Amazon Information are reported to Amazon at security@amazon.com within 24 hours of detection. Affected sellers are notified without undue delay.
9. Backups and resilience
Backups are encrypted, stored in geographically separated locations and rotated. Recovery is tested quarterly.
10. Vendors
Service providers are assessed before they receive access and annually thereafter, and are bound by written confidentiality and security terms. Our current sub-processors are listed in our Privacy Policy.
11. Personnel
Team members with access to seller data complete security awareness training when they join and annually thereafter, and are bound by confidentiality obligations.
12. Reporting a vulnerability
If you believe you have found a security vulnerability, please contact germbudllc@gmail.com. We acknowledge reports promptly and ask that you give us reasonable time to fix the issue before disclosure.