Trust
Data security and Amazon API use
What data the service touches, why it needs each piece, how it is protected, and what I will not claim. Written plainly so that a client, or an Amazon reviewer, can check it.
What the application does
Kovalchick Analytics operates a single purpose Amazon advertising optimisation system. For each seller who authorises it, the system reads advertising performance data, maintains a local mirror of the account structure, calculates the breakeven return on ad spend for each product from that product's own unit economics, and either recommends or applies changes to bids, budgets, negative keywords and campaign state so that advertising spend is directed at products and search terms that clear their own profitability bar.
It is operated by one person for a small number of client accounts. It is not a self serve SaaS product, it has no public sign up, and it does not resell data.
Marketplaces: any Amazon marketplace. Accounts operated to date are United States, Canada and Mexico, all within the North America region. Advertising outside that region uses a separate regional endpoint and a separate authorisation, which is set up per client before any data is pulled.
Amazon Advertising API
How authorisation works
Each advertiser authorises access to their own advertising profile, either through Amazon's Login with Amazon consent flow scoped to that profile, or by adding my user to their advertising account with viewer or editor permissions. Refresh tokens are stored per client, encrypted at rest, and are never written to source code, configuration files or logs. No client's token can be used to reach another client's profile: every API client instance is pinned to a single client identifier at construction.
What is read
- Sponsored Products campaigns, ad groups, keywords, product targets, negative keywords and campaign negative keywords
- Campaign, ad group, keyword, target and placement performance reports
- Search term reports
- Advertising profiles, for marketplace identification
What is written, and on which tiers
- Advisory tier: nothing. The daily write cap for this tier is zero and execution mode is forced to advise. This is enforced in four independent places in the code path, and the enforcement fails closed if the tier cannot be resolved.
- Execute, Growth and Continuous tiers: keyword and target bids, campaign daily budgets, negative keywords and campaign negative keywords, placement bid adjustments, campaign state, keyword state and keyword promotion between ad groups.
- No account level settings, no billing settings, no user permissions and no creative are ever written.
- Listing content. Listing text and keywords are written only where a client has asked for that work, and only to apply changes the client has reviewed and approved in advance. Nothing is published to a listing on the service’s own judgement. This path is disabled by default and is armed per client, in writing.
Amazon Selling Partner API
Where a client separately authorises it in Seller Central, the service reads selling account data that advertising data alone cannot provide. Each role requested exists for a stated purpose in the decision logic.
| Role requested | Why the application needs it |
|---|---|
| Brand Analytics | Read Search Query Performance, so a keyword’s organic search position is known before its ad bid is changed, and read the sales and traffic business report, so total advertising cost of sales is calculated against real total sales rather than last-click attributed ad sales. |
| Amazon Fulfillment | Read FBA inventory quantity, so advertising is not driven into a product about to stock out, and read customer returns, so realised margin reflects refunds rather than assuming every sale sticks. |
| Pricing | Read current offer price and buy box status. A product that has lost the buy box cannot convert, so its advertising is paused rather than left spending. |
| Product Listing | Read catalogue and listing attributes to map advertised ASINs to products, and to identify when poor performance is a listing problem rather than a bidding problem so the client can be told to stop spending. |
| Inventory and Order Tracking | Read order counts and status to time review solicitation and to tell a conversion problem from a traffic problem. Amazon classifies this role as not using the personally identifiable information required to ship an order. |
| Buyer Solicitation | Send Amazon’s own Request a Review message on eligible orders, inside Amazon’s allowed window, using Amazon’s template. No custom buyer message is ever sent and no buyer contact detail is received. |
| Selling Partner Insights | Read brand metrics, search term and share of voice data, so paid and organic placement on the same query can be compared and a client is not paying for a position they already hold. |
| Finance and Accounting | Read settlement level referral fees, fulfilment fees, refunds and reimbursements per order, so the profit floor is computed from what the seller was actually charged rather than an estimate. |
| Amazon Warehousing and Distribution | Read upstream inventory, so a product with thin FBA cover but deep reserve is not throttled needlessly. |
No restricted role is requested, and that is the point
Amazon marks the roles that unlock buyer personally identifiable information as Restricted: Direct-to-Consumer Shipping, Tax Invoicing, Tax Remittance, Selling Partner Support and Professional Services. None of them is requested by this application, and none ever will be for advertising work.
Buyer name, buyer email address, phone number and street address are reachable only through those roles. Without them the fields are not available to this application at all. That is a structural limit set by Amazon, not a promise I am asking you to take on trust, and it is why the statement below holds.
Personally identifiable information
The application is designed not to require customer personally identifiable information and does not request the Direct to Consumer Shipping role or any other restricted role that returns buyer data. No buyer names, addresses, phone numbers, email addresses or payment details are requested, processed, stored or displayed. Where any field constituting personally identifiable information appears in an API response it is not persisted to storage, and no such data is retained beyond 30 days under any circumstance.
Technical and organisational controls
| Control | Implementation |
|---|---|
| Encryption in transit | TLS 1.2 or higher for every API call and every outbound transfer. No unencrypted transport is used for Amazon data. |
| Encryption at rest | AES-256 on the datastore volume and on all backups. |
| Credential storage | Client refresh tokens and API secrets encrypted at rest, held outside the application source tree, never committed to version control and never emitted to logs. Authorisation headers are redacted before any logging call. |
| Key and secret rotation | Rotated at least annually, and immediately on any suspected exposure. |
| Access control | Least privilege. One operator. Multi factor authentication on the developer account, the Amazon accounts and the host. No shared credentials, no employees, no contractors, no third party access. |
| Tenant isolation | Single tenant datastore on owned hardware. Every stored row carries a client identifier. An automated invariant runs on every optimisation cycle and fails the cycle if any row is found under the wrong client. |
| Logging and monitoring | Security and audit logs retained for 24 months. Every write to an Amazon account is recorded with the client, the entity, the value before, the value after, the reason and a timestamp. |
| Change safety | Per client write caps, per client kill switch, profit floor, spend circuit breaker, data freshness gate, bid step caps and cooldowns. A cycle that cannot resolve a client's configuration fails closed and writes nothing. |
| Data retention | No personally identifiable information beyond 30 days, under any circumstance. Advertising and sales data retained up to 24 months to support year on year analysis. On the end of an engagement or a revoked authorisation, client data is deleted within 30 days. Deletion requests acknowledged within 72 hours and completed within 30 days. |
| Backup and recovery | Encrypted backups taken Monday, Wednesday, Friday and Saturday, matching the optimisation cycle windows, held on Google Drive and an encrypted external drive, with a restore tested quarterly. Backups are encrypted before they leave the host, so the storage provider holds ciphertext it cannot read. A deletion request reaches the backups as well as the live store, within the same 30 days, and deletion means deletion rather than anonymisation. |
| Incident response | Documented plan. A security incident affecting Amazon data is reported to Amazon and to the affected client within 24 hours of discovery, with a written follow up describing cause, scope and remediation. |
| Vulnerability management | Dependencies audited and patched on a monthly basis. Application dependencies are pinned. |
What a client can ask me to do at any time
- Show you the full log of every change made to your account.
- Stop all writes to your account immediately. There is a per client switch for this and it takes effect on the next cycle at the latest.
- Export everything I hold about your account in a machine readable format.
- Delete it. Acknowledged within 72 hours, completed within 30 days.
- Revoke my access yourself, in Amazon's own interface, without asking me first.
What I do not claim
This section is here because vague security language is how buyers get misled, and because you can check every claim above but you cannot check a claim I never made.
- I am not SOC 2 certified and I hold no third party security certification. Very few vendors in this category do, and the ones that say "aligned with" a standard do not hold it either. If you need a certified vendor, I am not one.
- I do not claim perfect isolation. I claim that I run an automated check for cross account data on every cycle, that the check has found defects, and that finding them is the point of having it. A vendor who tells you their isolation has never had a problem is either not looking or not telling you.
- I do not publish an uptime guarantee. The system runs on hardware I own and a missed weekly cycle is possible. Nobody in this category publishes a service level agreement, and I will not invent one.
- I do not guarantee advertising results. See section 6 of the terms of service.
Compliance with Amazon's own requirements
Use of the Amazon Advertising API and the Amazon Selling Partner API is governed by the applicable API licence agreements, the Amazon Acceptable Use Policy and the Amazon Data Protection Policy, all of which I have accepted. The controls in the table above are implemented to meet the Data Protection Policy requirements for encryption in transit and at rest, retention limits, access control, key rotation, logging and incident notification. Where those documents impose a stricter obligation than anything stated on this page, the stricter obligation applies.
Reporting a security issue
Email mathew@kovalchickanalytics.com with "Security" in the subject line. I will acknowledge within one business day. If you are a security researcher acting in good faith, I will not pursue you for reporting something you found without exploiting it.