Trust
Data security and Amazon API use
What data the service touches, why it needs each piece, how it is protected, and what I will not claim. Written plainly so that a client, or an Amazon reviewer, can check it.
What the application does
Kovalchick Analytics operates a single purpose Amazon advertising optimisation system. For each seller who authorises it, the system reads advertising performance data, maintains a local mirror of the account structure, calculates the breakeven return on ad spend for each product from that product's own unit economics, and either recommends or applies changes to bids, budgets, negative keywords and campaign state so that advertising spend is directed at products and search terms that clear their own profitability bar.
It is operated by one person for a small number of client accounts. It is not a self serve SaaS product, it has no public sign up, and it does not resell data.
Marketplaces: Amazon United States, Canada and Mexico (North America region).
Amazon Advertising API
How authorisation works
Each advertiser authorises access to their own advertising profile, either through Amazon's Login with Amazon consent flow scoped to that profile, or by adding my user to their advertising account with viewer or editor permissions. Refresh tokens are stored per client, encrypted at rest, and are never written to source code, configuration files or logs. No client's token can be used to reach another client's profile: every API client instance is pinned to a single client identifier at construction.
What is read
- Sponsored Products campaigns, ad groups, keywords, product targets, negative keywords and campaign negative keywords
- Campaign, ad group, keyword, target and placement performance reports
- Search term reports
- Advertising profiles, for marketplace identification
What is written, and on which tiers
- Advisory tier: nothing. The daily write cap for this tier is zero and execution mode is forced to advise. This is enforced in four independent places in the code path, and the enforcement fails closed if the tier cannot be resolved.
- Execute, Growth and Continuous tiers: keyword and target bids, campaign daily budgets, negative keywords and campaign negative keywords, placement bid adjustments, campaign state, keyword state and keyword promotion between ad groups.
- No account level settings, no billing settings, no user permissions, no creative and no listing content are ever written.
Amazon Selling Partner API
Where a client separately authorises it in Seller Central, the service reads selling account data that advertising data alone cannot provide. Each role requested exists for a stated purpose in the decision logic.
| Role requested | Why the application needs it |
|---|---|
| Brand Analytics | Read Search Query Performance, so a keyword’s organic search position is known before its ad bid is changed, and read the sales and traffic business report, so total advertising cost of sales is calculated against real total sales rather than last-click attributed ad sales. |
| Amazon Fulfillment | Read FBA inventory quantity, so advertising is not driven into a product about to stock out, and read customer returns, so realised margin reflects refunds rather than assuming every sale sticks. |
| Pricing | Read current offer price and buy box status. A product that has lost the buy box cannot convert, so its advertising is paused rather than left spending. |
| Product Listing | Read catalogue and listing attributes to map advertised ASINs to products, and to identify when poor performance is a listing problem rather than a bidding problem so the client can be told to stop spending. |
Personally identifiable information
The application is designed not to require customer personally identifiable information and does not request the Direct to Consumer Shipping role or any other restricted role that returns buyer data. No buyer names, addresses, phone numbers, email addresses or payment details are requested, processed, stored or displayed. Where any field constituting personally identifiable information appears in an API response it is not persisted to storage, and no such data is retained beyond 30 days under any circumstance.
Technical and organisational controls
| Control | Implementation |
|---|---|
| Encryption in transit | TLS 1.2 or higher for every API call and every outbound transfer. No unencrypted transport is used for Amazon data. |
| Encryption at rest | AES-256 on the datastore volume and on all backups. |
| Credential storage | Client refresh tokens and API secrets encrypted at rest, held outside the application source tree, never committed to version control and never emitted to logs. Authorisation headers are redacted before any logging call. |
| Key and secret rotation | Rotated at least annually, and immediately on any suspected exposure. |
| Access control | Least privilege. One operator. Multi factor authentication on the developer account, the Amazon accounts and the host. No shared credentials, no employees, no contractors, no third party access. |
| Tenant isolation | Single tenant datastore on owned hardware. Every stored row carries a client identifier. An automated invariant runs on every optimisation cycle and fails the cycle if any row is found under the wrong client. |
| Logging and monitoring | Application and security logs retained for 12 months. Every write to an Amazon account is recorded with the client, the entity, the value before, the value after, the reason and a timestamp. |
| Change safety | Per client write caps, per client kill switch, profit floor, spend circuit breaker, data freshness gate, bid step caps and cooldowns. A cycle that cannot resolve a client's configuration fails closed and writes nothing. |
| Data retention | No personally identifiable information beyond 30 days. Client performance data deleted 90 days after the engagement ends. Deletion requests acknowledged within 72 hours and completed within 90 days. |
| Backup and recovery | Encrypted backups taken Monday, Wednesday, Friday and Saturday, matching the optimisation cycle windows, held on Google Drive and an encrypted external drive, with a restore tested quarterly. |
| Incident response | Documented plan. A security incident affecting Amazon data is reported to Amazon and to the affected client within 24 hours of discovery, with a written follow up describing cause, scope and remediation. |
| Vulnerability management | Dependencies audited and patched on a monthly basis. Application dependencies are pinned. |
What a client can ask me to do at any time
- Show you the full log of every change made to your account.
- Stop all writes to your account immediately. There is a per client switch for this and it takes effect on the next cycle at the latest.
- Export everything I hold about your account in a machine readable format.
- Delete it. Acknowledged within 72 hours, completed within 90 days.
- Revoke my access yourself, in Amazon's own interface, without asking me first.
What I do not claim
This section is here because vague security language is how buyers get misled, and because you can check every claim above but you cannot check a claim I never made.
- I am not SOC 2 certified and I hold no third party security certification. Very few vendors in this category do, and the ones that say "aligned with" a standard do not hold it either. If you need a certified vendor, I am not one.
- I do not claim perfect isolation. I claim that I run an automated check for cross account data on every cycle, that the check has found defects, and that finding them is the point of having it. A vendor who tells you their isolation has never had a problem is either not looking or not telling you.
- I do not publish an uptime guarantee. The system runs on hardware I own and a missed weekly cycle is possible. Nobody in this category publishes a service level agreement, and I will not invent one.
- I do not guarantee advertising results. See section 6 of the terms of service.
Compliance with Amazon's own requirements
Use of the Amazon Advertising API and the Amazon Selling Partner API is governed by the applicable API licence agreements, the Amazon Acceptable Use Policy and the Amazon Data Protection Policy, all of which I have accepted. The controls in the table above are implemented to meet the Data Protection Policy requirements for encryption in transit and at rest, retention limits, access control, key rotation, logging and incident notification. Where those documents impose a stricter obligation than anything stated on this page, the stricter obligation applies.
Reporting a security issue
Email kovalchickanalytics@gmail.com with "Security" in the subject line. I will acknowledge within one business day. If you are a security researcher acting in good faith, I will not pursue you for reporting something you found without exploiting it.