How Masks.Health - Original Medical Masks Made Before COVID-19 protects Amazon seller and customer data used in our Amazon Account Management service. See also our Incident Response Plan and Privacy Policy.
Amazon customer personal information is used only for order fulfillment and carrier claims and is deleted within 30 days after order delivery, unless the law requires longer, in which case it is stored encrypted. Non-personal data (order IDs, SKUs, financial reports) is kept only as long as needed for accounting and tax, with the reason documented. All Amazon data is securely deleted (NIST 800-88) within 30 days of a seller revoking authorization or on Amazon’s request. Security logs (without personal information) are kept for 12 months.
All data in transit uses TLS 1.2 or higher (HTTPS, SSH-2/SFTP). Databases, backups and devices that store Amazon data are encrypted with AES-256. SP-API credentials are stored encrypted, never in source code or plain text. Encryption keys are rotated annually and revoked immediately if compromise is suspected.
Each user has a unique account (no shared or default logins), with least privilege and multifactor authentication. Passwords must be at least 12 characters with complexity; reuse of the last 10 is blocked; accounts lock after 10 failed attempts. SP-API client secrets and refresh tokens are rotated annually or immediately on suspected compromise. Access is reviewed quarterly and removed within 24 hours of a role change. Amazon data is never stored on personal devices or removable media.
Servers sit behind a default-deny firewall that exposes only HTTPS publicly. Administrative SSH access is key-based and IP-restricted. Anti-malware runs on all servers and workstations and is updated at least monthly. Vulnerability scans run monthly, with critical issues fixed within 7 days and high-risk issues within 30. A penetration test is performed annually, and patches are applied regularly.
Data questions or security concerns: sales@abdouexpress.com.
