Learn how Elitesecom handles and protects data received through Amazon Selling Partner API (SP-API), with a focus on security, privacy, access control, retention, and responsible data handling.
Elitesecom uses Amazon Selling Partner API (SP-API) to provide authorized ecommerce and order management functionality. We handle Amazon data only for legitimate service purposes.
Amazon Seller
Amazon SP-API
Elitesecom
Authorized Seller Workflow
Description of the Amazon-related data actually processed by Elitesecom.
Elitesecom may access customer information (such as names and shipping addresses) necessary for order fulfillment, shipping label generation, and customer service operations. This data is accessed only when authorized by the seller through the Amazon SP-API authorization process.
This information is required to fulfill orders, generate shipping labels, provide customer support, and reconcile payments — all core functions of the order management system.
Order processing, shipping label generation, customer communication, and payment reconciliation functionality may require access to this data.
Access is restricted to authorized Elitesecom personnel and automated systems based on role-based access controls. All access is logged and audited.
Data is protected through encryption, access controls, audit logging, and security monitoring. Protection measures are designed around the principles of SOC 2 Type II and ISO/IEC 27001:2022.
Access to Amazon-related data is restricted to authorized systems and personnel based on operational requirements.
Access controls based on user roles and responsibilities.
Users have only the access necessary for their specific roles.
Comprehensive logging of all Amazon data access and usage.
Periodic review and revocation of unnecessary access permissions.
How long Amazon-related data is kept, and how it is removed.
Buyer PII (restricted data): Buyer names, shipping addresses, and contact details are retained for a maximum of 30 days after order shipment, then automatically deleted or anonymized.
Non-PII order & financial records: Retained per the seller's contract and applicable statutory, tax, and audit requirements.
Authorization revoked: If SP-API authorization is revoked in Seller Central, sync stops immediately and retained Amazon data is deleted or anonymized per the schedule above.
Deletion requests: Sellers can request earlier deletion of their data at any time via dpo@elitesecom.ai.
Elitesecom's commitment to responsible handling of Amazon SP-API data and applicable requirements.
Amazon data is accessed only with explicit seller authorization through the Amazon SP-API OAuth 2.0 process
Data processing is limited to the specific scope authorized by the seller and necessary for service delivery
Security controls are designed around the principles of SOC 2 Type II and ISO/IEC 27001:2022
Regular security assessments including VAPT to identify and remediate vulnerabilities
Amazon data is not used for advertising purposes or sold to third parties
Security incidents involving Amazon Information are reported to security@amazon.com within 24 hours of detection
For questions about Elitesecom's Amazon SP-API security and data handling practices, please contact:
security@elitesecom.aiTo see what the integration does, visit our page.