How we protect your data

RepriceMax operates as a Public Solution Provider on the Amazon Selling Partner API. We comply with the Amazon Services API Data Protection Policy and the Acceptable Use Policy while aligning our internal controls with industry-recognised frameworks (ISO 27001, SOC 2 Type II principles, and the OWASP ASVS).

• All traffic to RepriceMax — including the marketing site, the application, the public API, and webhooks — is served over HTTPS with TLS 1.2 or higher. HSTS is enabled on the production domain.
• Amazon Information and other sensitive data are encrypted at rest using AES-256 in the database, in object storage, and in backups.
• SP-API refresh tokens and LWA credentials are stored in encrypted form, are never written to application logs, and are scoped to the minimum roles required for the features each seller enables.
• Payment information is handled exclusively by Stripe, a PCI DSS Level 1 certified processor. RepriceMax never sees or stores raw card numbers.

• Customer access to the application is protected by salted password hashing (bcrypt), optional Google single sign-on, and JWT-based session management with short-lived tokens.
• Each customer's data is isolated by tenant (team) at the application layer; queries are scoped to the authenticated team for every request.
• Production access by RepriceMax personnel is restricted on a strict need-to-know basis, requires multi-factor authentication, and is recorded in an immutable audit log.
• Privileged actions inside the application (e.g. inviting team members, rotating API keys, disconnecting marketplaces) are logged and surfaced to the account owner.

• RepriceMax runs on reputable cloud infrastructure providers (AWS for storage and email, plus a managed compute environment for the application and SQL Server database).
• Databases and internal services are deployed in private subnets behind firewalls and are not exposed to the public internet.
• Operating systems, runtimes, and dependencies are patched on a regular cadence; critical vulnerabilities are tracked and remediated within defined SLAs.
• Production deployments go through automated build, dependency-scanning, and rollout pipelines; manual changes in production are restricted and reviewed.

We retain customer and Amazon Information only for as long as needed to provide the service or comply with applicable law.

You may disconnect your Amazon Seller Central account at any time from the application's settings. To request full deletion of your account and all associated Amazon Information, email privacy@repricemax.com.

• Application and infrastructure events are captured by structured logging (Serilog) and forwarded to a centralised logging system for monitoring and alerting.
• Health checks run continuously against the database and critical dependencies; failures trigger on-call notifications.
• Encrypted backups are taken on a regular schedule and tested for restore.
• Suspicious activity — repeated failed logins, anomalous API key usage, unusual SP-API traffic — is automatically flagged for review.

We maintain a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review. If we become aware of a security incident affecting Amazon Information, we will:

• Notify Amazon within 24 hours, as required by the SP-API Data Protection Policy.
• Notify affected sellers without undue delay, including the nature of the incident, the data affected, and the steps we have taken.
• Cooperate with Amazon and any regulators or law enforcement as required.
• Conduct a post-mortem and implement corrective measures to prevent recurrence.

We use a small, carefully chosen set of sub-processors to operate the service. Each is bound by contract to handle data in line with our Privacy Policy and the Amazon SP-API Data Protection Policy.