Access to Amazon accounts
- Kovru connects only through Amazon's official authorization (Login with Amazon and Selling Partner API authorization). We never ask for or store your Seller Central password.
- We request only the data roles the service needs: advertising, listings, pricing, inventory, fulfillment, finance and brand analytics. We do not request roles that give access to buyer personal information.
- You can revoke access at any time from Seller Central or the Amazon Ads console.
Encryption
- All traffic uses TLS 1.2 or higher.
- Data at rest is encrypted (AES-256). Amazon refresh tokens are additionally encrypted and stored separately from other data.
- Secrets and keys are kept in managed secret stores, never in source code.
Access control
- Only authorized staff can reach production systems, with the least access their job needs.
- Multi-factor authentication is required on every admin and cloud account.
- Access is reviewed regularly and removed promptly when no longer needed.
Changes to your account
- Every change is shown to you first and applied only after your approval.
- Guardrails limit how far a bid can move in one run.
- Every applied change is logged with its rule, time and who approved it.
Monitoring and incidents
- We log access to systems that hold Amazon data and watch for unusual activity.
- If we suspect a security incident involving Amazon data, we notify Amazon at security@amazon.com within 24 hours of detecting it, and we inform affected customers without delay.
- We keep a written incident response plan and test it at least once a year.
Data retention
Amazon data is kept only as long as needed to provide the service and deleted within 30 days after you disconnect or close your account. Uploaded files in the PPC Optimizer are processed in your browser.
Report a concern
Email hello@kovru.com with the subject "Security". We reply within 2 business days.