Last updated: 4 October 2026
Marketplace accounts are valuable business assets. This page explains how we protect them and the information inside them.
1. Scope
This page describes the security controls
2. Network protection
- Firewalls, network access control lists and identity-based access controls deny access to unauthorised entities.
- Networks are segmented so systems that handle marketplace information are isolated from general office and guest networks.
- Intrusion detection and prevention, and a web application firewall, protect all internet-facing endpoints.
- Malware and endpoint protection run on every device that accesses, processes or stores information.
- Devices lock automatically after a maximum of 15 minutes of inactivity.
3. Access management and least privilege
- Each team member has a unique user account. Shared or generic logins are not allowed.
- Access follows least privilege and need-to-know: only the marketplace roles needed for the agreed work are requested and granted.
- Access lists are reviewed at least every 90 days. Access is removed within 24 hours when a person changes role or leaves, and when an engagement ends.
- Sellers keep ownership of their accounts and can revoke our access at any time.
4. Credentials and authentication
- Multi-factor authentication (TOTP, hardware token or biometric) is required on all accounts, including marketplace, email and any system holding client data.
- Passwords are at least 12 characters with mixed case letters, numbers and special characters, must not contain the user’s name, and cannot reuse any of the last 10 passwords. Minimum password age is 1 day and maximum is 365 days.
- Accounts lock after 10 or fewer failed login attempts, and unusual login activity is monitored.
- Credentials and API keys are stored only in an encrypted, approved password manager or key management system, never in code, documents, email or chat. API keys are rotated at least once a year and immediately if compromise is suspected.
5. Encryption
- All information in transit is encrypted using TLS 1.2 or higher, SFTP or SSH-2, wherever data crosses a network boundary or is sent to a third party.
- Information at rest, including backups, is encrypted using AES-256 (at minimum AES-128), with keys held separately from the data.
6. Personally identifiable information (PII)
- Buyer PII is accessed only when strictly needed for a seller-authorised task, such as resolving a shipping or return issue.
- PII is retained for no longer than 30 days after order delivery, unless the law requires longer, in which case it is archived only in encrypted storage.
- PII is never copied to removable media, personal devices or unapproved storage.
- Every access to PII is logged.
7. Logging and monitoring
- Security-relevant events (logins, failed logins, permission changes, data access and deletion) are logged.
- Logs are retained for at least 90 days, protected from tampering, and reviewed for unusual activity.
- Alerts are tested regularly to confirm they work.
8. Vulnerability and risk management
- Vulnerability scans run at least every 30 days and a penetration test at least once every 12 months on systems that handle PII.
- Critical and high-risk issues are fixed as a priority and tracked to closure.
- Software and devices are kept on supported, updated versions.
- A risk assessment is carried out at least once a year and reviewed by company management, with documented roles, responsibilities and decision-making authority.
9. Incident response
We maintain a written incident response plan approved by company management, reviewed at least every six months and after any major infrastructure change or lesson learned. A designated Incident Management Point of Contact, a company director, leads every response, supported by a documented internal escalation path.
- Preparation: trained team, current contact lists, asset inventory, tested backups and logging in place.
- Identification: detect and verify the incident, record the time of detection, assess severity, and identify affected systems, accounts and data.
- Containment: isolate affected systems, revoke or reset compromised credentials and API keys, remove suspicious access and block further data exposure.
- Eradication: remove the root cause, such as malware, unauthorised accounts or a vulnerability, and patch affected systems.
- Recovery: restore from clean, verified backups, confirm systems are secure and monitor closely before returning to normal operation.
- Lessons learned: within 14 days, document the cause, timeline and actions, and update controls, training and this plan.
If an incident involves Amazon Information, we notify Amazon at security@amazon.com within 24 hours of detection. Affected sellers are informed promptly with regular status updates, and government agencies, including CERT-In, are notified as required by law.
10. Data retention, return and deletion
- Data is kept only as long as needed for the authorised purpose or required by law.
- All marketplace information, including all live copies, is permanently deleted within 30 days of the earliest of: Amazon or the seller asking us to delete it; the seller revoking or ending our access; our authorisation ending; or the service ending.
- Deletion uses secure, industry-standard sanitisation methods (NIST SP 800-88).
- Deletion is confirmed in writing on request.
11. People and training
- All staff sign confidentiality agreements before receiving any access.
- Staff receive security and data-protection training when they join and at least once a year.
- Background checks are carried out for roles with access to client data, where permitted by law.
12. Review
These controls, our internal security policy and this page are reviewed at least every six months and after significant changes to our systems or to marketplace policies.
13. Report a concern
To report a suspected security or privacy issue, email info@sspecommerce.com or call +91 72248 13564 with a short description and a safe way to contact you. Please do not send passwords, tokens or unnecessary personal data.