Security

1. Overview

Growth Amazon operates an e-commerce analytics dashboard that connects to marketplaces and advertising platforms — including Amazon Seller Central, Amazon Vendor Central, Amazon Advertising, Google Ads, Google Analytics (GA4), Google Search Console, and Noon — to surface sales, inventory, orders, and campaign performance in one place. Because this involves handling sensitive business data and API credentials on behalf of our clients, security is a core part of how the platform is designed and operated.

This page summarizes our security practices at a high level. It is not a substitute for a formal, legally reviewed security policy or a signed data processing agreement, which we can provide on request.

2. Infrastructure & Transport Security

• All in-browser traffic to the dashboard is encrypted in transit using TLS (HTTPS); unencrypted connections are not permitted.
• Application servers, databases, and background job workers run in managed cloud infrastructure with restricted network access between services.
• Backups and cached report data are stored on infrastructure with encryption at rest, where supported by the underlying provider.

3. Credential & Integration Handling

Connecting a marketplace or advertising account (e.g. Amazon SP-API, Amazon Advertising, Google Ads, GA4, Search Console, or Noon) requires API credentials, refresh tokens, or OAuth authorization. We handle these as follows:

• All integration workflows are performed server-side. API keys, refresh tokens, and secrets are never exposed to, or handled by, the client's browser.
• Credentials are stored using environment-scoped secrets management and are not stored in application logs or client-visible responses.
• Integrations request the minimum API scopes necessary to fetch the reports available in the dashboard — nothing broader.
• Any connected account's access can be revoked at any time by disconnecting the integration or rotating the underlying credentials on the marketplace/platform side.

4. Access Control & Workspace Isolation

• Every authenticated user is scoped to their assigned client workspace; cross-workspace data access is not permitted at the application layer.
• Internal access to production data is limited to personnel who need it to operate or support the platform, following a least-privilege model.
• Passwords are stored using secure, industry-standard hashing — never in plain text.

5. Data Protection & Minimization

We follow data minimization principles: only the fields required for analytics, reporting, and caching (e.g. order totals, ad performance metrics, inventory counts) are stored. We avoid retaining raw marketplace or advertising data beyond what is needed to power dashboards and reports, and cached data is refreshed or purged on a regular cycle.

6. Monitoring & Audit Logging

Key operations — such as authentication events, integration connections/disconnections, credential refresh cycles, and data sync jobs — are logged in an audit-friendly format. These logs support troubleshooting, anomaly detection, and investigation of any suspected unauthorized access.

7. Operational Safety & Data Freshness

Advertising and marketplace reports (e.g. Amazon Ads, Google Ads, SP-API sales data) may take time to synchronize from the source platform. The dashboard uses safe caching and progressive refresh so that users do not see inconsistent partial totals while a sync is in progress, and reports clearly reflect the data's last-updated time where relevant.

8. Third-Party Integration Security

We connect only to official, documented APIs provided by our integration partners — Amazon (SP-API, Advertising API, Vendor Central), Google (Ads API, GA4 API, Search Console API), and Noon (Partner API) — using authorized credentials or OAuth flows. We do not use unofficial scraping methods to retrieve marketplace or advertising data. Each third-party platform's own security and privacy practices also apply to data it processes on its end.

9. Incident Response

In the event of a suspected security incident affecting client data or connected accounts, we aim to:

• Investigate and contain the issue as quickly as possible.
• Notify affected clients with relevant details once the scope of the incident is understood.
• Take corrective action, which may include rotating affected credentials or temporarily disabling impacted integrations.

10. Responsible Disclosure

If you are a security researcher and believe you have found a vulnerability in our platform, please report it to us privately using the contact details in Section 12 before any public disclosure. We appreciate good-faith research conducted without accessing or modifying other clients' data, and we will work with you to investigate and resolve valid reports.

11. Compliance & Best Practices

Our practices are informed by common industry standards for SaaS security (such as least-privilege access, encryption in transit, and secure credential storage). This page is a summary and does not constitute a formal compliance certification; if your organization requires a specific compliance attestation, security questionnaire, or data processing agreement, please contact us.

12. Contact & Support

For security questions, incident reporting, or vulnerability disclosures, please reach out to us:

• Email: support@growithamazon.com
• Contact form: Contact page

See also our Privacy Policy and Terms & Conditions.