Pointof Security and Amazon SP-API Data Protection Policy

1. Amazon Information Usage

Pointof accesses Amazon Information only after an authorized Amazon seller grants permission through the Amazon Selling Partner API authorization process.

Amazon Information is used only to provide authorized seller features such as:

• Order management
• Inventory management
• Product listing management
• Pricing workflows
• Tax invoicing workflows
• Fulfillment and shipment workflows
• Operational reporting

Amazon Information is not sold, rented, shared, used for advertising, profiling, or used for unrelated purposes.

2. Access Control

Access to Amazon Information is restricted based on user role, business need, and job function.

Each user or administrator has an individual account. Shared accounts are not allowed for Amazon Information access.

Users are granted only the minimum level of access required to perform their duties. Access is reviewed periodically and removed when no longer required.

3. Password and MFA Requirements

Pointof enforces password and authentication requirements for users and administrators who can access Amazon Information. The required controls include:

• Minimum password length of 14 characters
• Password complexity requirements including at least 2 special characters
• Mandatory Multi-Factor Authentication (MFA/2FA) for all users and administrators
• Password expiration every 180 days
• Regular password and credential rotation
• No shared accounts
• No hard-coded passwords, API keys, client secrets, refresh tokens, or encryption keys in application source code

4. Credential and Secret Management

Credentials, API keys, client secrets, refresh tokens, encryption keys, and passwords are stored securely.

Secrets are not stored in public repositories, not shared through insecure channels, and not hard-coded into application source code.

Pointof uses secure environment variables, Kubernetes secrets, or equivalent secure secret management mechanisms for sensitive credentials.

Access to secrets is restricted to authorized administrators only.

5. Encryption

Amazon Information is encrypted in transit using HTTPS/TLS.

Amazon Information stored at rest is protected using database and storage encryption with AES-128 or stronger encryption where applicable.

Keys and secrets are managed separately from application source code, and access is restricted to authorized administrators.

6. Personally Identifiable Information Retention

Personally Identifiable Information received from Amazon is retained only as long as required to provide authorized seller workflows such as invoicing, fulfillment, shipment preparation, and order processing.

Pointof's retention policy is to delete or anonymize Amazon PII in less than 31 days after order delivery, unless a longer retention period is required by applicable law or tax obligations.

7. Testing and Development

Production Amazon PII is not copied to local developer machines.

Testing is performed using synthetic, masked, or anonymized data whenever possible.

If Amazon Information is required in a test environment, it is protected with the same access control, encryption, and retention rules as production data.

Application changes are evaluated in a dedicated test environment before production release.

8. Logging and Monitoring

Pointof maintains security and application logs for:

• Login attempts
• Authentication and authorization events
• Password changes
• MFA enable/disable events
• Administrator access
• Amazon integration access
• Amazon credential changes
• Suspicious or unusual activity

Logs are retained for a minimum of 12 months and reviewed at least bi-weekly.

Suspicious activity is investigated, documented, contained, and escalated according to the incident response process.

9. Vulnerability Management

Pointof follows a vulnerability management process for systems handling Amazon Information. The process includes:

• Regular vulnerability scans
• Code vulnerability scanning before release
• Dependency and package review
• Remediation tracking
• Annual penetration testing where applicable

Critical findings are targeted for remediation within 7 days. High severity findings are targeted for remediation within 30 days.

10. Change Management

Pointof maintains a change management process for production changes.

Changes are tested, verified, and approved before production release. Access to deploy production changes is restricted to authorized personnel.

Security-related changes, credential changes, and Amazon integration changes are logged and reviewed.

11. Incident Response

Pointof maintains an incident response process for security incidents involving Amazon Information. The process includes:

• Detection
• Triage
• Containment
• Investigation
• Eradication
• Recovery
• Documentation
• Notification

For database hacks, unauthorized access, or data leaks, affected access is immediately restricted, credentials are rotated, logs are reviewed, impacted systems are isolated, fixes are applied, and recovery steps are documented.

If Amazon Information is affected or suspected to be affected, Amazon will be notified at [email protected] within 24 hours of detection.

12. Outside Parties

Pointof does not share Amazon Information with outside parties.

Amazon Information is used only within Pointof to provide order management, inventory, listing, pricing, invoicing, fulfillment, reporting, and operational workflow features to the authorized seller.

13. External Sources

Amazon Information is retrieved only from the Amazon Selling Partner API after seller authorization.

Within Pointof, Amazon Information may be combined with the seller's own Pointof data and other authorized sales channel data for operational workflows.

14. Incident Management Point of Contact

PointOf Ticaret Eko Sistemi — [email protected]