Trust & Security
Amazon SP-API Security
How we protect information received from Amazon through the Selling Partner API.
OAuth onlyWe never see your Amazon password.
Buyer data protectedUsed only for invoices and labels.
30-day deletionAfter revocation or request.
24-hour reportingIncidents reported to Amazon.
This page explains how HM Square Solutions LLP (Speed E-Com Solution) protects information received from Amazon through the Selling Partner API ("Amazon Information"). It supplements our Privacy Policy and Security page.
1.Seller Authorisation
- Access is granted by the seller through Amazon's OAuth 2.0 (Login with Amazon) consent flow in Seller Central.
- We never ask for, receive or store your Amazon Seller Central username, password or one-time codes.
- We receive an authorisation token limited to the roles the seller approved. Tokens are stored encrypted and used only to call the API for that seller.
- The seller can revoke access at any time in Seller Central. Revocation stops all further API calls.
2.Data We Access and Why
| Data | Purpose |
|---|---|
| Settlement, fee and refund data (Finance and Accounting) | Reconciling payouts to orders and calculating SKU-wise profit and loss for the seller. |
| Order status, quantities and inventory levels (Inventory and Order Tracking) | Matching orders to payouts and showing stock alongside financial data for the seller. |
| Product listing data, including titles, descriptions, images and A+ content (Product Listing) | Creating and updating the seller's own product listings when the seller publishes them. |
| Tax invoice data, including buyer name, address and tax registration number (Tax Invoicing, restricted) | Generating GST tax invoices for the seller's B2B and B2C orders. |
| Shipping details, including buyer name, address and phone number (Direct-to-Consumer Shipping, restricted) | Generating shipping labels for orders the seller ships directly to customers. |
| Tax collection and remittance data (Tax Remittance, restricted) | Reconciling taxes collected and remitted on the seller's orders. |
| Seller account and performance information (Selling Partner Insights) | Showing performance next to the seller's reconciliation data. |
| Search-term and sales reports for the seller's own brand (Brand Analytics) | Showing brand insights to that seller only. |
Buyer personal data. The restricted roles above give us buyer personal data such as name, address, phone number and tax registration number. We use it only to generate the seller's tax invoices and shipping labels. We do not use it for marketing, contact buyers with it, or combine it with other data. Only authorised staff and automated systems can access it, every access is logged, and it is encrypted in transit and at rest.
3.How We Use and Do Not Use Amazon Information
- We use Amazon Information only to provide the reconciliation service to the seller who authorised access.
- We do not sell, rent, license or disclose it to third parties, except service providers acting for us under confidentiality obligations or where the law requires.
- We do not use it for advertising or marketing, or to train machine-learning models.
- We do not aggregate it across sellers, or use it to monitor, compare or target other sellers or competitors. Brand Analytics data is shown only to the seller whose brand it covers.
- We do not send it to third-party AI providers.
4.Access Control
- Each seller's data is kept separate from other sellers' data.
- Within a seller's account, access follows role-based permissions set by that seller.
- Our staff can access Amazon Information only where needed to operate or support the service, and each access is logged.
- We review staff access periodically and remove access that is no longer needed.
5.Data Protection
- Amazon Information is encrypted in transit using TLS.
- Authorisation tokens and stored data are encrypted at rest.
- Access to Amazon data and to the systems that hold it is recorded in audit logs, which we retain for 12 months.
- Regular backups are taken and are subject to the same retention and deletion rules as the data they contain.
6.Retention and Deletion
- Reconciliation data is kept while the seller's account is active, so the seller can view history and reports.
- On revocation or deletion request, syncing stops immediately and Amazon Information is deleted or anonymised within 30 days, except records that tax, audit or other law requires us to keep.
- Buyer personal data is deleted or anonymised within 30 days after the order is delivered. Tax invoices generated for the seller are the seller's own legal records and stay in the seller's account.
- Sellers can ask for earlier deletion at any time by emailing speedecomsolution@gmail.com.
7.Incident Response
- Detect and contain. We monitor for unauthorised access and, on suspicion, isolate affected systems and revoke affected credentials and tokens.
- Notify. A security incident involving Amazon Information is reported to Amazon at security@amazon.com within 24 hours of detection, and affected sellers are informed.
- Remediate and review. We fix the cause, restore service and record what changed to prevent a repeat.
8.Security Contact
For security questions or to report a vulnerability, email speedecomsolution@gmail.com.
HM Square Solutions LLP (Speed E-Com Solution)
508, KBC-1 (Karunesh Business Center), Opposite Abhishek Arcade, Kiran Chowk, Surat – 395010, Gujarat, India