Last updated: 15 October 2026
Company: Tech-Magnet LLC
Contact: security@tech-magnet.com

1. Purpose and Data Scope

Tech-Magnet LLC maintains technical, administrative, and organizational safeguards to protect information obtained through Amazon’s Selling Partner API (SP-API).

Access to Amazon Information is restricted to authorized business activities, including order management, packing, shipment preparation, delivery tracking, returns, and related fulfillment support.

We request only the minimum API permissions and Personally Identifiable Information (PII) required for approved operations.

2. Network Protection and Infrastructure Security

Our applications operate within secured Microsoft Azure environments.

Security controls include:

• Azure network security rules and firewalls restrict access to application infrastructure.

• Azure SQL databases are not publicly accessible.

• Database and storage access is restricted to approved applications, authorized services, and permitted network connections.

• Administrative and developer access is limited to authorized personnel through individual accounts and role-based permissions.

• Managed developer endpoints are protected by endpoint security software, firewalls, access restrictions, and malware protection.

• Network events and suspicious connections are monitored through centralized security logging.

Public access to databases and restricted storage resources is prohibited.

3. Endpoint Security and Personal Device Restrictions

Amazon Information is accessible only through approved business systems and authorized application environments.

The following controls protect Amazon Information from unauthorized transfer:

• Personal USB storage devices and unauthorized removable media are restricted from accessing or storing Amazon PII.

• Personal mobile phones and unmanaged devices are prohibited from storing Amazon Information.

• Endpoint security policies enforce approved device access.

• Data loss prevention and endpoint monitoring controls detect attempted unauthorized copying, downloading, or transfer of sensitive information.

• Security alerts are generated for detected policy violations and suspicious device activity.

• Authorized administrators investigate alerts, review audit records, and restrict access or isolate affected endpoints where necessary.

Devices and systems that process Amazon Information are subject to inventory, configuration, and access reviews.

4. Encryption at Rest and Key Management

Amazon Information is protected using industry-standard encryption.

• AES-256 encryption protects supported Azure SQL databases, storage, and encrypted backup data.

• TLS 1.2 or higher protects information transmitted between applications, services, and external endpoints.

• Azure Key Vault is used to securely manage application secrets and cryptographic keys under restricted access permissions.

• Key and secret access is restricted to authorized application identities and designated administrators.

• Cryptographic key access is controlled through role-based authorization and auditable operations.

• Encryption-key lifecycle procedures include periodic review, scheduled rotation, and immediate revocation or replacement when compromise is suspected.

• Managed endpoints that store protected information are subject to encryption and endpoint-security requirements.

Encryption credentials and secrets must not be exposed in application source code or publicly accessible configuration files.

5. Backup Security and Disaster Recovery

Encrypted database and application backups are maintained for business continuity and disaster recovery.

• Backups are encrypted at rest using AES-256 protection.

• Recovery copies are maintained in geographically separated Microsoft Azure regions.

• The primary environment uses Azure US East 2, with geographically separated recovery arrangements supporting continuity.

• Access to backup and restoration operations is restricted to authorized administrators.

• Backup and restore operations follow controlled, documented recovery procedures.

• Recovery involves identifying an approved recovery point, restoring affected data, validating data integrity, and verifying application functionality.

• Backup and recovery procedures are tested quarterly.

Recovery Time Objective (RTO): Target 24 hours.

Recovery Point Objective (RPO): Target up to 24 hours.

Recovery arrangements remain subject to applicable Amazon PII deletion and retention requirements. Backup retention must not permit prohibited retention or restoration of expired Amazon PII.

6. Access Control and Employee Identification

Each authorized employee is assigned an individual user account.

Access to Amazon Information is granted according to job responsibility and the principle of least privilege.

• Shared user accounts are prohibited.

• Role-based access controls restrict sensitive functions.

• Multifactor authentication is required for privileged administrative and developer access.

• Access permissions are reviewed periodically and when responsibilities change.

• Access is revoked within 24 hours of employee termination or loss of authorization.

• Administrative actions are logged and reviewed.

7. Security Logging, Monitoring, and Alerts

Tech-Magnet LLC uses Azure Monitor and Azure Log Analytics for centralized security logging and monitoring.

Monitoring covers application activity, access attempts, administrative operations, API activity, and relevant server and database security events.

Alerts are used to identify:

• Failed or repeated login attempts

• Unauthorized access attempts

• Unusual SP-API activity or unexpected request patterns

• Privilege or permission changes

• Suspicious data access or transfer

• Endpoint security and device-policy violations

• Abnormal application or infrastructure behavior

Amazon customer PII is excluded from security and application logs unless logging it is specifically required by applicable law or regulation.

Where identifiers are needed for security correlation, non-sensitive references or appropriately de-identified values are used.

Security logs are access-controlled, protected against unauthorized changes, and retained for at least 12 months.

Security activity is monitored using automated alerts, and formal log reviews are conducted at least every two weeks.

When suspicious activity is detected, authorized security personnel review event timestamps, affected identities, source systems, access history, and related security evidence.

Investigation results, containment actions, corrective measures, and closure verification are documented.

8. Amazon PII Retention and Secure Deletion

Amazon PII is retained only for authorized order fulfillment and legally permitted purposes.

Amazon PII is securely deleted or irreversibly anonymized no later than 30 days after order delivery unless longer retention is specifically required by applicable law.

Where a legal, tax, or regulatory obligation requires longer retention, only the information necessary for that obligation is retained, solely for the required purpose and duration.

Retention rules cover production databases, temporary storage, archives, and backups.

Amazon Information is also deleted according to applicable Amazon authorization-revocation, termination, and deletion requirements.

9. Testing and Non-Production Environments

Testing is performed using synthetic, masked, or anonymized information.

Production Amazon PII is not routinely copied to development or testing environments.

Any exceptional production-data access needed for troubleshooting must be authorized, restricted, logged, time-limited, and subject to secure deletion after use.

10. Credential and Password Management

Credentials are protected through secure storage, restricted permissions, and individual authentication.

• Application secrets are managed through approved secure configuration and key-management services.

• Hard-coded credentials and unauthorized credential sharing are prohibited.

• Passwords must contain at least 12 characters, including uppercase letters, lowercase letters, numbers, and special characters.

• Passwords must not contain the user’s name.

• Password history and expiration controls are enforced according to organizational policy.

• Access attempts are monitored, and repeated failed logins result in account restrictions or lockout.

• Compromised credentials are revoked or replaced promptly.

11. Vulnerability Management and Secure Development

Tech-Magnet LLC maintains a vulnerability-management process covering application development and production operations.

Security activities include:

• Application code and dependency scanning before software releases

• Vulnerability scanning of systems processing Amazon Information at least every 30 days

• Annual penetration testing

• Monitoring for vulnerable software libraries and infrastructure components

• Reviewing runtime security findings and suspicious application behavior

• Documented tracking of discovered vulnerabilities

Each finding is classified by severity and assigned to an accountable owner.

Remediation may involve code corrections, dependency updates, security patches, configuration changes, or temporary access restrictions.

Critical vulnerabilities must be remediated within 7 days, and high-severity vulnerabilities within 30 days of discovery.

Corrections are tested in an approved environment before production release. Vulnerabilities are rescanned or otherwise verified after remediation, and findings remain tracked until closure.

12. Incident Response and Notification

Tech-Magnet LLC maintains documented procedures for detecting, investigating, containing, remediating, and recovering from security incidents.

In the event of suspected unauthorized access, database compromise, data leakage, or credential exposure, the response includes:

1. Detection through security monitoring and alerts.

2. Initial investigation and incident classification.

3. Restricting compromised accounts or isolating affected systems.

4. Preserving relevant audit logs and evidence.

5. Assessing the scope and impact on Amazon Information.

6. Remediating vulnerabilities and replacing compromised credentials.

7. Restoring affected services and verifying system integrity.

8. Documenting corrective actions and preventive improvements.

Security incidents involving Amazon Information are reported to security@amazon.com within 24 hours of detection, in accordance with Amazon SP-API requirements.

Applicable legal and regulatory notification obligations are also addressed.

13. Third-Party Infrastructure

Microsoft Azure provides the authorized cloud infrastructure, database, storage, key-management, monitoring, and backup services used to support Amazon SP-API integrations.

Access by service providers is restricted to approved operational purposes and applicable data protection requirements.

14. Incident Management Point of Contact (IMPOC)

Name: Ripin Kaur
Email: security@tech-magnet.com

15. Policy Review

This policy is reviewed periodically and updated when material changes occur in security controls, infrastructure, applicable laws, or Amazon SP-API requirements.