Data Protection & Security

Last updated: November 2, 2026

Neuroshelf is designed to meet Amazon Selling Partner API Data Protection Policy expectations. Here's how we protect your data.

Official authorization only

You connect through Amazon's OAuth authorization flow. We never see or store your Seller Central password, and you can revoke access from Seller Central or Neuroshelf at any time.

Encryption

• Amazon refresh tokens are encrypted at rest with AES-256-GCM; keys are stored separately from data.
• All traffic uses HTTPS/TLS 1.2+.

Minimum data, no PII roles

We request only the roles needed for listing, pricing, inventory, FBA and finance. We do not request restricted buyer-PII roles.

Per-customer isolation

Your private seller data (listings, costs, orders summaries, finances, settings) is isolated per customer account and never visible to other customers.

Shared public market data

To power sales-rank history and sold-days estimates, we keep a shared pool of public product market data only — sales rank (BSR), offer counts and prices, and Buy Box status. It contains no seller-identifying or buyer information.

Access control & monitoring

Production access is limited to authorized personnel with multi-factor authentication. We log access and review security events.

Deletion

When you disconnect Amazon, tokens are revoked and deleted immediately and private data is deleted within 30 days, or sooner on request to support@neuroshelfai.com.

Incident response

If a security incident affects your data, we will notify you and Amazon within 24 hours as required by Amazon policy.

Report a vulnerability

Email security@neuroshelfai.com.

Data Protection & Security contact

Questions or requests about data protection, security or deletion: security@neuroshelfai.com