Security

Your Amazon data is treated like bank-level assets — because it is.

Amazon Credentials

  • We never see or store your Amazon password
  • Access is granted only through Amazon's official OAuth flow
  • Refresh tokens are encrypted at rest with AES-256 and stored in a private Supabase vault

Encryption

  • All data in transit: TLS 1.3 (enforced)
  • All data at rest: AES-256 encryption (database + backups)
  • Tokens are never logged, written to disk unencrypted, or visible in logs

Infrastructure

  • Hosted on Supabase (SOC 2 Type II, ISO 27001, HIPAA-eligible)
  • Backend runs on Railway with private networking and automatic security updates
  • Frontend served via Vercel with built-in WAF and DDoS protection

Access Controls

  • Only the founder has access to production encryption keys
  • All admin actions require MFA + hardware key
  • IP allow-listing and rate limiting on all API endpoints

Incident Response

  • 24-hour detection & notification policy
  • Any suspected breach involving Amazon data is reported to security@amazon.com within 24 hours (per SP-API requirements)
  • Documented, tested incident response plan reviewed every 6 months

Data Minimization & Deletion

  • We only pull the reports required to calculate reimbursements
  • No buyer PII is ever requested or stored
  • On cancellation or request: refresh token is revoked instantly and all seller data is permanently deleted within 24 hours

Compliance

  • Fully compliant with Amazon SP-API Data Protection Policy
  • Regular third-party penetration tests and vulnerability scans

We built ReclaimFBA the same way we protect our own 7-figure seller accounts —

paranoid, minimal, and locked down.

Security Questions?