Data protection and retention
What Amazon's Acceptable Use Policy (AUP) and Data Protection Policy (DPP) require of every SP-API developer: data use, retention and deletion, security controls and audits.
A summary, not the policy
Every statement on this page restates Amazon's published policies, linked under Sources. Section numbers refer to the Data Protection Policy (DPP). The policies themselves are binding; this page is a summary of them.
Numbers at a glance
- PII is retained no longer than 30 days after order delivery (2.1).
- Information is deleted within 30 days of a deletion notice or a revoked authorization (1.7).
- Books and records are kept during the agreement and for 12 months after it ends (3).
- A Security Incident is reported to Amazon within 24 hours of detection (1.6.3).
- Access is disabled or removed within 24 hours of termination (1.2.3).
- Screen lock: automatic timeout after at most 15 minutes (1.1.2).
- Access rights reviewed at least quarterly; lock-out after at most 10 consecutive failed log-ins (1.2.2).
- Passwords: at least 12 characters, expiry at most 365 days, no reuse of the last 10 (1.4.1).
- Programmatic credentials rotated at least once every 12 months (1.4.2).
- Encryption in transit: TLS 1.2 or higher (1.5); at rest: at least AES-128 or RSA with a 2048-bit key (2.4).
- Incident response plan reviewed and verified every six months (1.6.2).
- Logs reviewed in real time or at least every 2 weeks and retained for at least 12 months (2.6.1).
- Vulnerability scans at least every 30 days, penetration tests at least every 365 days (2.7.1, 2.7.2).
- Critical vulnerabilities fixed within 7 days, high-risk ones within 30 days of discovery (2.7.3).
Who the policies apply to
The Data Protection Policy sets the requirements for solution providers — developers and service providers.
- Its Section 1 (general security requirements) applies to every solution provider building an SP-API application.
- Section 2 adds requirements for solution providers that perform restricted operations involving personally identifiable information (PII), which the restricted roles unlock.
- Every developer also accepts the Acceptable Use Policy (AUP).
Definitions (DPP Section 4)
- Information — any information exposed through the Amazon Services API, public or non-public, including PII.
- PII — information that can be used on its own or with other information to identify, contact, identify in context, or locate an Amazon customer. For example: name, address, e-mail address, phone number, payment details, cookies, IP address, geo-location.
- Security Incident — any actual or suspected unauthorized access, collection, disclosure, corruption or loss of Information.
Acceptable use (AUP)
- Use the API only to perform acceptable Amazon activities, and only for authorized users; do not facilitate or promote the violation of any agreement between an authorized user and Amazon.
- Do not falsely advertise the application. Be clear and honest with authorized users about what data is accessed and for what purpose, including the calculations and models, such as artificial intelligence, applied to it.
- Do not deceive authorized users by deliberately modifying Information.
- Never share access keys or passwords, and never request or accept an authorized user's or another solution provider's access keys.
- Grant access to data on a need-to-know basis within the organization.
- Do not use or promote external data services that vend information retrieved from Amazon's websites.
- Do not disclose Information to other application users, affiliated entities or any outside parties without proper authorization.
PII use limits
Do not use PII about customers for any purpose other than merchant-fulfilled shipping or meeting legal requirements. Do not target Amazon customers for product marketing, or for review fabrication or modification.
No cross-business aggregation
Do not aggregate data across authorized users' businesses or customers.
Retention and deletion
PII retention (2.1)
Retain PII for no longer than 30 days after order delivery, and only for the purpose of, and as long as necessary to:
- (i) fulfill orders;
- (ii) calculate and remit taxes;
- (iii) produce tax invoices and other legally required documents;
- (iv) meet legal requirements, including tax or regulatory requirements.
PII may be kept longer than 30 days after delivery only if required by law, and only to comply with that law.
Data deletion (1.7)
Permanently and securely delete Information within 30 days when Amazon gives notice requiring deletion, or when the customer of the solution provider revokes its authorization.
Records (3)
Maintain all appropriate books and records during the agreement and for 12 months after it ends.
Security requirements for every developer (Section 1)
Section 1 applies to every solution provider building an SP-API application.
Incident notice
Notify Amazon at [email protected] within 24 hours of detecting a Security Incident (1.6.3).
Section 1, area by area
- Network protection (1.1.1)
- Network segmentation to isolate sensitive environments and limit lateral movement.
- A web application firewall (WAF) or equivalent controls to monitor, filter and block malicious API traffic.
- Endpoint protection, with manual updates applied at least monthly.
- Endpoint protection (1.1.2) — screen lock with automatic timeout after at most 15 minutes.
- Documentation (1.1.3) — documentation of network and endpoint controls: network architecture diagrams and evidence of deployed firewalls, WAF, IDS/IPS and endpoint protection.
- Identity governance (1.2.1)
- A documented process to request, approve, provision, review and revoke access by business need.
- A unique identifier per user.
- No generic, shared or default accounts.
- Access reviews (1.2.2) — review access rights at least quarterly; lock an account after at most 10 consecutive failed log-ins.
- Termination (1.2.3) — disable or remove access within 24 hours of termination.
- Approved users (1.2.4) — only approved users: personnel with a documented business need who completed data protection and IT security awareness training, repeated at least annually.
- Least privilege (1.3) — access to Information is limited to the minimum necessary to perform authorized functions.
- User authentication (1.4.1)
- Multi-factor authentication (MFA) for all user accounts.
- Passwords, where used: at least 12 characters, no part of the user's name, a mix of upper- and lower-case letters, numbers and special characters.
- A minimum password age of one day, expiry at most 365 days, no reuse of the last 10.
- Programmatic credentials (1.4.2) — rotate at least once every 12 months.
- Encryption in transit (1.5) — encrypt all Information in transit with secure protocols such as TLS 1.2 or higher.
- Risk and incidents (1.6)
- A risk assessment covering threats, vulnerabilities, likelihood and impact (1.6.1).
- An incident response plan reviewed and verified every six months (1.6.2).
- Notify Amazon at
[email protected]within 24 hours of detecting a Security Incident (1.6.3). - Investigate and document each incident, keep the chain of custody for evidence and make the documentation available to Amazon on request (1.6.4).
- Designate an Incident Management Point of Contact (1.6.5).
Additional requirements for PII (Section 2)
Section 2 applies to solution providers that perform restricted operations involving PII.
Section 2, area by area
- Data governance (2.2)
- A documented privacy and data handling policy.
- A record of processing activities per PII field (collection, processing, storage, use, sharing, disposal).
- A process to detect and comply with applicable privacy and security laws.
- A privacy policy covering consent and the rights to access, rectify, erase or stop processing.
- Support for authorized users' data subject access requests.
- Confidentiality clauses in the contracts of employees who process PII.
- Asset management (2.3) — an accurate asset inventory, updated quarterly (2.3.1); no PII on removable media unless encrypted with at least AES-128 (2.3.2).
- Encryption at rest (2.4) — encrypt all PII at rest with at least AES-128 or RSA with a 2048-bit key or larger.
- Secure coding (2.5) — secure coding practices aligned with industry standards.
- Logging (2.6.1)
- Log security-relevant events — success or failure, date and time, access attempts, data changes, system errors.
- Logs contain no PII unless legally required.
- Review logs in real time or at least every 2 weeks; retain logs for at least 12 months.
- Monitoring (2.6.2)
- Alarms on suspicious activity (multiple unauthorized calls, unexpected request rates and retrieval volumes, access to canary records).
- Detection of Information found beyond its protected boundaries.
- Documented investigations.
- Vulnerability management (2.7)
- Vulnerability scans at least every 30 days (2.7.1).
- Penetration tests at least every 365 days (2.7.2).
- Remediate critical vulnerabilities within 7 days and high-risk ones within 30 days of discovery (2.7.3).
- Disaster recovery (2.7.4) — documented restore procedures and a geographically separated secondary or backup site for timely restoration of PII access.
- Subcontractors (2.8) — third-party risk assessments of vendors and subcontractors, annually, before granting them access to Amazon data.
Audit and assessment (Section 3)
- On Amazon's written request a solution provider certifies in writing that it complies with the policies.
- On reasonable request Amazon, or an independent certified public accounting firm Amazon selects, may audit, assess and inspect the books, records, facilities, operations and security of all systems involved.
- Deficiencies found must be remediated at the solution provider's own cost within an agreed time frame.