Amazon OAuth
Customers authorize on Amazon-hosted screens. SellerPilot does not collect or store Amazon account passwords, and authorization can be revoked.
Security and data protection
Protect the connection, isolate the customer, verify every boundary.
SellerPilot is a multi-tenant SaaS platform for authorized Amazon advertising data. Its security model starts with Amazon-hosted OAuth, encrypted refresh credentials, server-side organization and resource checks, bounded synchronization jobs, secure sessions, and minimal data disclosure. Security is an operational program—not a badge, an Amazon endorsement, or a guarantee that risk can be eliminated.
Core control areas
Defense in depth for an account-connected product.
No single control protects a SaaS platform. SellerPilot combines identity, authorization, encryption, tenant scoping, operational monitoring, safe error handling, and customer control.
Credential protection
Refresh credentials are encrypted server-side and excluded from browser responses, logs, analytics views, and customer-facing error messages.
Session security
Authenticated requests use server-validated session state, secure cookie controls, expiration, logout invalidation, and rate limits on sensitive endpoints.
Tenant isolation
Organizations, memberships, connections, profiles, jobs, reports, billing state, and protected resources are scoped and checked on the server.
Operational traceability
Synchronization state, retries, timestamps, errors, source windows, and future action history are designed to remain reviewable.
Minimal disclosure
Interfaces and APIs return only the fields required for the authorized workflow. Secrets and raw provider errors are not exposed to other tenants.
01 / Identity and authorization
Authenticate the user, then authorize the exact resource.
A valid login is only the first boundary. Protected operations must also verify organization membership, role, resource ownership, connection ownership, advertiser profile scope, and the permission required by the action. A user from one tenant must not access a record simply by guessing an identifier or modifying a request.
SellerPilot uses server-side checks for sensitive routes and does not rely on a hidden button as authorization. Session state is validated for protected requests, sensitive authentication endpoints are rate limited, and logout invalidates the active session. Password reset flows use time-limited, single-purpose tokens without revealing whether an email address belongs to an account.
- Organization and resource ownership checks
- Role-aware server-side authorization
- Rate limits on authentication and sensitive operations
- Safe, non-enumerating recovery responses
02 / Amazon connection
Use revocable authorization, never shared passwords.
SellerPilot starts the connection process, but the customer completes authorization with Amazon. The application does not ask the customer to type Amazon credentials into a SellerPilot form. After a successful callback, the connection is associated with the correct organization and used only for the permitted product workflow.
Refresh credentials are sensitive secrets. They are encrypted at rest by the application and remain server-side. They must not be included in browser payloads, analytics events, routine logs, support screenshots, or customer-visible errors. Revocation and deletion requests are handled through the support and privacy processes described on the public policy pages.
- Amazon-hosted OAuth authorization
- Encrypted refresh credentials
- State validation during the callback flow
- Connection and synchronization status without secret exposure
03 / Data and synchronization
Keep customer data scoped through every job.
Background work creates a second authorization surface. A queued synchronization job must retain the organization, connection, account, and profile context that was authorized when it was created. Workers validate ownership before accessing provider credentials or writing campaign and reporting records. Retries are bounded so a temporary provider failure does not create an uncontrolled loop.
Reporting status is part of data integrity. SellerPilot records whether work is queued, running, completed, or failed and exposes a data-through timestamp to the authorized customer. Missing or delayed data is not converted into a zero-performance conclusion. Provider error details are mapped to safe operational messages while sensitive internals remain protected.
- Tenant context retained in job records
- Bounded retries and observable status
- Safe error translation
- Freshness and source-window visibility
04 / Lifecycle and third parties
Limit use, retention, and transfer.
SellerPilot processes Amazon advertising data to provide the customer-authorized service, operate synchronization, secure the platform, troubleshoot support issues, and meet legal obligations. Retention should be tied to an active account, operational necessity, contractual requirements, and documented deletion procedures. Customers can contact support to request connection revocation, account closure, or applicable data rights.
SEMrush is used only as a supplementary intelligence source for SellerPilot’s own public marketing and competitor research. It is not an Amazon Ads data source and is not used to combine, enrich, or review a customer’s Amazon account data. External AI or MCP review with ChatGPT, Claude, Gemini, or another provider is not a live feature and would require a separately assessed, minimally scoped, explicitly authorized design.
- Purpose limitation and data minimization
- Customer support path for revocation and deletion
- No sale or publication of customer Amazon data
- No external AI review represented as available
Security support
Report a suspected security or privacy issue.
Email support@getsellerpilot.com with a clear description, affected URL or account context, and safe reproduction details. Do not send passwords, access tokens, refresh credentials, full payment-card details, or unnecessary customer data. The support team will acknowledge and triage the report through the applicable incident process.
OperatorThe Home Mart FZC LLCBusiness addressSPC Free Zone, Sharjah, UAESupport phone+971 50 418 5190Support languageEnglish
Review the policies before authorizing account access.
Security controls reduce risk, but no online service can promise absolute security. Read the privacy policy, terms, integration scope, and current feature matrix before starting a trial.