Information Security Policy & Incident Response Plan

1. Network Access Controls & Infrastructure Protection

SellersOS employs a defense-in-depth network architecture to prevent unauthorized access to Amazon Information and systems:

• Perimeter Web Application Firewall (WAF): All incoming public internet traffic is filtered through Cloudflare Enterprise WAF and AWS Managed Rules, blocking OWASP Top 10 vulnerabilities, automated botnets, SQL injection, cross-site scripting (XSS), and Layer 7 DDoS attacks.
• Private Database Network Isolation: All PostgreSQL production databases are deployed in isolated internal subnets without public internet ingress. Direct connections from unauthorized external IPs are rejected at the AWS Security Group firewall level.
• Port & Service Minimization: Only standard HTTPS (port 443) is exposed for web applications. Administrative SSH access (port 22) is strictly restricted, requiring dedicated Ed25519/RSA private key pairs; password-based SSH authentication is disabled.

2. User Access Limitation & Principle of Least Privilege

Access to Amazon Information is strictly limited to authorized personnel and system components based on business duties:

• Logical Multi-Tenant Isolation: Each merchant workspace is strictly partitioned at the database layer. Selling partners can only access their own authorized Amazon account data; cross-tenant data leakage or querying is architecturally prohibited.
• Role-Based Access Control (RBAC): Granular permissions are managed through a centralized authority engine (src/lib/permissions.ts). User roles (Administrator, Inventory Operations, Advertising Manager, Financial Viewer) restrict access strictly to necessary business functions.
• Server-Side Authorization Enforcement: Every API call and server action validates authentication and effective role scopes at the server layer. Client-side interface hiding is always accompanied by server-side 403 Forbidden enforcement.
• Quarterly Access Audits: User accounts and privileges are reviewed quarterly. Access for terminated employees or contractors is revoked within 24 hours.

3. Cryptographic Standards (In Transit & At Rest)

• Encryption in Transit: 100% of network communications involving Amazon Information are encrypted using TLS 1.2 or higher (TLS 1.3 preferred) with HTTP Strict Transport Security (HSTS) enforced across all endpoints (max-age=31536000). Plaintext HTTP is permanently redirected to HTTPS.
• API Transport Security: All programmatic communication to Amazon Selling Partner API (SP-API) and Amazon Advertising API is conducted exclusively over encrypted HTTPS endpoints.
• Encryption at Rest: Persistent databases, storage volumes, and backups are encrypted using AES-256 with AWS Key Management Service (AWS KMS). Amazon API client secrets and OAuth refresh tokens are encrypted at rest using authenticated AES-256-GCM (src/lib/crypto.ts).

4. Incident Response Plan & Amazon 24-Hour Notification

SellersOS maintains an active Incident Response Plan (IRP) governed by designated Security Points of Contact:

• Continuous Monitoring & Telemetry: Real-time telemetry detects brute-force authentication attacks, SQL injection attempts, rate-limiting violations, and API anomalies, triggering automated alerts to our 24/7 security on-call team via Telegram and syslog.
• Incident Triage & Containment: The response procedure defines rapid containment workflows: revoking compromised OAuth tokens, isolating affected compute instances, rotating encryption keys, and maintaining forensic audit records.
• Security Contact: Inquiries, vulnerability disclosures, and incident notifications should be addressed to [email protected].

5. Password Policy & Account Lockout (Amazon DPP §1.4.1)

SellersOS strictly enforces minimum password security standards for all administrative and user accounts:

• Minimum Length: All user passwords must be at least 12 characters long.
• Character Complexity:Passwords must contain a combination of uppercase letters (A–Z), lowercase letters (a–z), numbers (0–9), and special characters/symbols (!@#$%^&*).
• Identity Exclusion:Passwords must not contain the user's username, email prefix, or brand name.
• Automated Account Lockout: Accounts are automatically locked out for at least 30 minutesafter 8 consecutive failed login attempts (strictly within the ≤10 failed attempts threshold over a 30-minute window specified by Amazon DPP §1.4.1).
• Session Security: Inactivity timeouts automatically lock sessions, and idle web sessions expire after 15 minutes of inactivity.

6. Secure Credential & Key Storage

• Password Hashing: User passwords are never stored in plaintext. Passwords are hashed using the memory-hard scrypt algorithm with a cryptographically secure 16-byte random salt.
• No Hardcoded Credentials: Source code repositories do not contain hardcoded credentials, API secrets, or private keys. Environment configuration files are isolated with strict chmod 0600 permissions.
• Zero Client Exposure: Secret keys, tokens, and backend database credentials are strictly retained in server-side memory and are never serialized or transmitted to client web browsers.

7. Third-Party Sub-Processors & Data Ingestion Disclosures

In compliance with Amazon Solution Provider disclosures:

• Authorized External Sub-Processors: Amazon Web Services, Inc. (AWS) processes authorized Amazon seller data for application hosting, database storage, encrypted backups, and system logging. Cloudflare, Inc. processes request metadata and network transit traffic for reverse proxy, WAF, and DDoS mitigation. Amazon Information is never sold, leased, or disclosed to third parties for marketing or advertising purposes.
• Authorized Amazon Data Sources: SellersOS retrieves Amazon Information exclusively from official Amazon Selling Partner API (SP-API) and Amazon Advertising API endpoints for selling partners who grant explicit OAuth 2.0 authorization. SellersOS does not scrape Amazon websites or purchase seller data from data brokers.