Security and data
Your access stays yours. Your data never mixes with anyone else’s.
Agents working inside your Amazon account must be more careful than a person, not less. Here are the rules they follow.
The rules
Six rules
- 01
Keys in your name
The Amazon application (SP-API) is created in your company’s name and authorised by you, on your accounts only. Never another client’s application, never ours. You can revoke the authorisation at any time.
- 02
One vault per client
Your keys are kept in a vault of your own, entered without ever appearing on screen. Never sent by email or chat.
- 03
Separation per client
Your data, your agents, your Vendor Central session, your outgoing mailboxes: no agent starts for you until all of it is separated from other clients. Before acting, each agent checks it is on your account.
- 04
Read-only by default
The audit only reads. Every agent that writes to Amazon has its own switch, off until you say yes.
- 05
A person approves
Anything that commits your money or can’t be undone is prepared by the agent and approved by a person.
- 06
Everything is logged
Every agent run leaves a trace in its log: when, what it did, and why it stopped if it did.
Decisions
Who decides what
Three levels, agreed with you before the first agent.
-
Level 1 You
Always your decision
Lowering a cost, accepting a co-op agreement or a bulk buy request, disputing a chargeback, issuing a credit note. The agent prepares the wording, documents and deadline; a person clicks.
-
Level 2 The agent, within your rules
Within your written rules
Accepting or rejecting a line based on your thresholds, ordering from a supplier, sending an ASN, opening a case with proof of delivery. The agent acts only within the boundaries you’ve approved, and only after its dry-run week.
-
Level 3 The agent
On its own, no risk
Reading, checking, comparing, matching, alerting, preparing.
A rule only moves from one level to another by your decision.
Suppliers
Your suppliers see their lines. Nothing else.
Each supplier has its own page: its orders, its replies, its documents. It sees neither your selling prices, nor your margins, nor your other suppliers, nor any other client. Before opening any access, we check that it returns no data that isn’t theirs.
What a supplier sees
- Its orders
- Its replies
- Its documents
What it never sees
- Your selling prices
- Your margins
- Your other suppliers
- Other clients
Never
What we never do
- Display, copy or keep a password or key in plain text.
- Use one client’s access for another.
- Write to Amazon during an audit.
- Change a rule on your behalf.
And this website?
It sets no cookies and contains no trackers. The contact form sends nothing: it shows our email address.
A question from your IT team?
We walk your IT or finance lead through how we work, on your actual account.