Policy updateAmazon’s revised Data Protection Policy applies from 25 Nov 2025

Pass Amazon’s data protection review. First time.

We turn Amazon’s SP-API requirements into written policies, working controls and test evidence, then help you submit with confidence.

Book a readiness call Take the 1-minute check

SP-API submission readinesssample engagement

Policies0/4

Information securityIn progress

Data retentionGap

Incident responseGap

Access controlGap

Controls0/4

PII encrypted at restGap

Tokens in a vaultGap

MFA enforcedGap

Dispersed backupsGap

Evidence0/4

30-day scan reportGap

Penetration testGap

Retest closedGap

Submission packGap

30 days

Between vulnerability scans

7 days

To fix critical vulnerabilities

24 hours

To report a security incident

12 months

Maximum between penetration tests

Requirement by requirement

What Amazon asks for, what we do, and what you hand over.

Security governance

DPP · General

Amazon asks

A documented information security programme with named responsibilities.

We do

Write a policy suite that reflects how your team actually operates.

You receive

Six bespoke policies, reviewed with you and signed off.

Encryption

DPP · PII

Amazon asks

PII encrypted in transit and at rest, with managed keys.

We do

Trace every place Amazon data lives and check how it is encrypted.

You receive

A data-flow diagram and encryption evidence per store.

Access and credentials

DPP · General

Amazon asks

Least-privilege access, MFA, and protected LWA credentials.

We do

Review IAM, token storage and rotation, and admin access paths.

You receive

An access control matrix and remediation list.

Retention and deletion

DPP · PII

Amazon asks

PII kept only as long as needed, then deleted, including backups.

We do

Map retention by data type and test that deletion really happens.

You receive

A retention schedule and deletion procedure.

Vulnerability management

DPP · 2025 update

Amazon asks

Scans every 30 days, annual pen tests, critical fixes in 7 days.

We do

Run the scans and an SP-API-focused penetration test, then retest.

You receive

Scan reports, test report and closure evidence.

Incident response

DPP · General

Amazon asks

A tested plan, with Amazon notified within 24 hours of an incident.

We do

Write the plan and walk your team through a tabletop exercise.

You receive

An incident response plan and exercise record.

Your evidence pack

Written for your business. Not a template.

Reviewers can tell when a policy was downloaded. Ours describe your systems, your people and your data flows, and they match what the test report shows.

Information security policy
Data protection policy
Access control policy
Encryption standard
Retention and deletion
Incident response plan
Vulnerability management
Third-party risk

1-minute readiness check

How close are you?

Question 1 of 6

Is Amazon customer PII encrypted wherever you store it?

Databases, file storage, logs and backups.

Questions we hear

Straight answers.

Can you guarantee Amazon approves us?

No one can guarantee Amazon’s decision. We make sure your controls, documents and evidence meet the policy, and support you through follow-up questions.

Do we need this if we don’t access PII?

General security requirements apply to every SP-API integration. Stricter controls and testing apply once you access PII. We confirm which on the call.

We already have policies. Can you use them?

Yes. We keep what works and fill the gaps. Many clients only need a few documents rewritten.

Is a standard penetration test enough?

Often not. Amazon expects testing focused on systems that handle its data, including token handling and PII storage.

What changed in November 2025?

Shorter scan intervals, fixed remediation deadlines, dispersed backups and third-party risk assessments for subcontractors.

How long does a full audit take?

It depends on your current documents and how quickly fixes land. We plan around any Amazon deadline you have.

Find your gaps before Amazon does.

A 30-minute call with a consultant who knows the policy. You leave with a clear list of what to fix.