Security & data handling

1. What we connect to

Amazon Advertising API (scope advertising::campaign_management ), Selling Partner API, Amazon Marketing Cloud and Amazon DSP, each through Amazon's own authorization flow. You grant Advertising and Seller Central access separately and can revoke either from your Amazon account at any time; revocation stops all activity on that account within about 15 minutes.

2. What we write, and when

By default nothing is written to your account. A change is applied only after a user on your account confirms it, within a delegation you define by fix type, ASIN or campaign with a start and end date, or through an MCP key you gave a write scope. Every write records the tool call, the request, the response, the operator and a seven-day before-and-after measurement. Declined recommendations are recorded as declined.

3. Where your data lives

Production data is hosted on Alibaba Cloud, US West (Silicon Valley) region: relational store, analytics warehouse and object storage. Language-model calls for report narration, listing copy and chat answers are served by Anthropic (Claude) and OpenAI (GPT) through their APIs, whose terms do not permit using your data to train their models; we send the data needed for the task and no more. Tool execution against Amazon goes through Amazon's official Ads MCP endpoints in NA, EU or FE.

4. Isolation

Each customer is a separate tenant. Every query is filtered by tenant, and non-admin users are further restricted to the seller / ASIN / marketplace combinations assigned to them, enforced in server middleware. AI tools used in the report chat and over MCP cannot accept tenant or permission parameters.

5. Keys and credentials

• MCP access keys are scoped (read per area; write separately), expiring and revocable; the full key is shown once and the list shows only a prefix and last-used time.
• Amazon authorization tokens are stored server-side in an access-controlled database and never exposed to clients.

6. Logging and audit trail

Operations, recommendation impressions, every applied action (with Amazon's response), every MCP tool call and every listing write (with a pre-write snapshot) are logged. You can see the action ledger in the console.

7. What we don't have yet

No SOC 2, ISO 27001 or similar certification. No self-serve data-deletion endpoint — deletion is handled on request within 30 days. We would rather list these than imply otherwise. If your vendor review needs a questionnaire completed, send it to coolwcc@sapientia.tech .

8. Reporting a vulnerability

Email coolwcc@sapientia.tech . We acknowledge within two business days and keep you informed until it is fixed. Please don't access other customers' data while testing.