Guarding your data is the product.
ASINRx exists to protect Amazon Vendor businesses. That obligation starts with how we handle the data you authorize. This page is a factual overview — not a marketing checklist.
Authorized, read-only, revocable
ASINRx connects to Amazon only through the Selling Partner API authorization you grant via Login with Amazon, or through report files you provide. Access is read-only. We never ask for your Amazon password, secret keys, session cookies, or shared portal credentials — and you can revoke the authorization at any time from Amazon or from ASINRx.
In transit and at rest
All traffic is served over HTTPS with HSTS. Amazon refresh tokens are encrypted at rest with rotating application-layer keys; access tokens are requested per use and never stored. Databases and storage are encrypted at rest by our infrastructure providers.
Enforced in the database, not just the app
Customer data is isolated per tenant with PostgreSQL row-level security. The application's runtime database role cannot bypass those policies, so a request for one customer's data is constrained to that customer at the database layer — a stricter guarantee than application-side filtering alone.
No cross-customer use. No training.
Your data is used to provide the service to you. It is never aggregated across customers into benchmarks or shared datasets, never sold, and never used to train AI or machine-learning models. Details are in the Amazon Data Handling notice.
Defense in the request path
Secure, HTTP-only session cookies; CSRF protection on every form; clickjacking denial; signed webhook verification for billing events; rate limiting on authentication and public endpoints; and audit logging on sensitive operations.
Records that can't be quietly rewritten
Legal-document versions are content-addressed and immutable, consent records are append-only, and operational audit trails record who did what. When we say a case was verified closed, the record shows it.
Our operating standards
Unique accounts and least-privilege access for every person and system. Multi-factor authentication for personnel with access to customer data. Defined retention and deletion schedules for every class of data we hold — including hard maximums for platform-sourced business data. Due diligence and written data-protection terms for every vendor. Security logging, monitoring, and vulnerability management. And a tested incident-response plan with prompt notification to affected customers and platforms. The binding detail lives in our Privacy Policy and Amazon Data Handling notice.
Found something? Tell us first.
Report suspected vulnerabilities or security incidents to security@asinrx.com. We acknowledge reports promptly, we won't take legal action against good-faith research that respects customer data, and we ask that you not access data that isn't yours. Please don't run automated scans against the service without written approval.