Data Security & Incident Response

Incident response plan

Our incident response plan covers database breaches, unauthorized access and data leaks. It is owned by our Managing Director as incident lead, supported by our data protection officer (Valentin Lätzsch), our in-house development team and our hosting providers. It consists of six phases:

1

Preparation

Documented roles and contact lists, least-privilege access with individual accounts and multi-factor authentication, encryption of Amazon data in transit (TLS) and at rest, centralized access and application logging, and regular backups.

2

Detection and analysis

Monitoring of access logs, failed logins, unusual API activity and database queries; alerts from our hosting providers. Every suspected incident is logged immediately, classified by severity and checked for whether Amazon data or end-customer personal data is affected.

3

Containment

Immediate isolation of affected systems or accounts, revocation of compromised sessions, and rotation of all potentially exposed credentials, including SP-API/LWA client secrets and refresh tokens. If Amazon data may be affected, SP-API access is suspended until the system is secured.

4

Notification

Amazon is notified at security@amazon.com within 24 hours of detection. Affected clients (sellers) are informed without delay. Where required under Art. 33/34 GDPR, the competent supervisory authority is notified within 72 hours and affected individuals are informed.

5

Eradication and recovery

Root cause analysis, removal of the vulnerability or malicious access, restoration from clean backups, verification of data integrity, and controlled restart of services with enhanced monitoring.

6

Post-incident review

Documentation of the incident, its impact and the measures taken; lessons learned are fed into our security controls and the plan itself. The plan is reviewed at least once a year and after every significant incident.