Last Updated: 1 August 2026
Effective Date: 1 August 2026

This Security Policy describes the security practices and controls that Ample Wings Overseas (“Ample Wings,” “we,” “us,” or “our”) applies to its websites, applications, systems and services, including AW Co-Pilot AI, our web-based AI-powered marketplace management platform.

AW Co-Pilot is designed to connect with supported marketplaces and ecommerce platforms and may process product, listing, pricing, inventory, order and other marketplace information. Certain marketplace integrations, particularly Amazon Selling Partner API integrations involving personally identifiable information (“PII”), require enhanced security controls.

This policy is intended to complement our Privacy Policy, Data Deletion Policy, Terms & Conditions, Acceptable Use Policy and applicable marketplace/API agreements.

Implementation requirement: The controls described below should only be published as implemented controls once your development/infrastructure team has actually configured them. Amazon explicitly requires developer-profile security answers to accurately reflect the organization's implemented practices.

---

1. About Ample Wings Overseas

Ample Wings Overseas is an ecommerce, marketplace management, digital marketing and technology services business.

Our services include:

• Marketplace Management
• Marketplace Onboarding
• Digital / Performance Marketing
• Web Design & Development
• Ecommerce Account Management
• Listing & Cataloguing
• Product Import Services
• Logistics Services
• Technology services
• AW Co-Pilot AI

AW Co-Pilot is our web-based software platform for centralized ecommerce and marketplace management.

---

2. Security Objectives

Our security program is designed around the following objectives:

Confidentiality

Protect customer, marketplace and business information from unauthorized access or disclosure.

Integrity

Protect information from unauthorized modification, corruption or manipulation.

Availability

Maintain reliable access to AW Co-Pilot and its supporting systems.

Accountability

Maintain appropriate records and controls so that security-related activity can be investigated.

Data Minimization

Access and retain only information reasonably necessary for the requested functionality.

---

3. Information Covered by This Policy

Security controls may apply to:

• Customer account information
• Business information
• Product information
• Product images
• Listing information
• Pricing information
• Inventory information
• Order information
• Marketplace information
• API credentials
• OAuth tokens
• Authentication information
• Application logs
• Security logs
• Billing information
• Support communications
• AI-processing inputs and outputs
• Other information processed through AW Co-Pilot

Amazon's current SP-API security guidance specifically requires appropriate protection of Amazon information and additional controls for PII accessed through restricted roles.

---

4. Security Governance

Ample Wings maintains responsibility for the security of the AW Co-Pilot environment.

Security responsibilities include:

• Security architecture
• Access management
• Credential management
• Data protection
• Vulnerability management
• Incident response
• Monitoring
• Backup and recovery
• Data deletion
• Third-party security management

Personnel and contractors who receive access to confidential information are expected to follow applicable confidentiality and security requirements.

---

5. Authentication

AW Co-Pilot uses authentication mechanisms designed to prevent unauthorized access.

Depending on the account type and functionality, controls may include:

• Strong passwords
• Secure password storage
• Session management
• Authentication tokens
• Multi-factor authentication (“MFA”) where supported
• Login monitoring
• Account lockout/rate limiting
• Password-reset verification

Passwords should never be stored in plain text.

---

6. Role-Based Access Control

Access to AW Co-Pilot information is based on user roles and operational requirements.

We apply the principle of least privilege, meaning users and systems should receive only the permissions necessary to perform their authorized functions.

Potential roles may include:

• Account owner
• Administrator
• Staff user
• Support user
• Developer
• System/service account

Production access should be more restricted than development or testing access.

---

7. Administrative Access

Administrative and privileged access is restricted to authorized personnel.

Where technically applicable:

• Privileged accounts are separately controlled.
• Administrative access requires authentication.
• Access is granted according to job responsibilities.
• Privileged access is reviewed periodically.
• Access is removed when no longer required.
• Administrative actions may be logged.

---

8. Developer Access

Developers should not receive unrestricted production access unless operationally necessary.

Development access should use:

• Dedicated accounts
• Least-privilege permissions
• Separate development environments
• Restricted production credentials
• Secure authentication
• Confidentiality obligations
• Access logging where appropriate

Production credentials must not be shared through ordinary chat, email or publicly accessible repositories.

---

9. API Credential Security

Marketplace API credentials, OAuth tokens, refresh tokens, encryption keys and other secrets are treated as sensitive information.

We aim to:

• Store credentials securely.
• Prevent credentials from appearing in source code.
• Prevent credentials from being committed to public repositories.
• Restrict credential access.
• Rotate credentials where appropriate.
• Revoke compromised credentials.
• Remove credentials when marketplace connections are terminated.

Amazon specifically requires SP-API keys and credentials to be protected and not exposed in plaintext.

---

10. Amazon Selling Partner API Security

When AW Co-Pilot uses Amazon SP-API, we apply security controls appropriate to the requested Amazon roles.

Amazon categorizes SP-API roles into restricted and non-restricted roles. Restricted roles may provide access to PII and therefore require enhanced security controls.

For restricted-role applications, Amazon may conduct:

1. Business review
2. Security review
3. Technical/architecture review

Amazon states that the technical review can include detailed discussion and verification of security architecture and controls.

---

11. Encryption in Transit

We use encrypted network communications for sensitive information.

Where applicable, AW Co-Pilot uses:

HTTPS / TLS

for:

• User access
• API communications
• Marketplace communications
• Internal service communications
• Third-party service connections

Amazon's current encryption guidance requires Amazon information in transit to be encrypted and specifically recommends TLS 1.3 / HTTPS for applicable communications.

Unencrypted communication channels should not be used for Amazon information.

---

12. Encryption at Rest

Sensitive information stored by AW Co-Pilot should be protected using appropriate encryption-at-rest controls.

For Amazon PII, Amazon's current guidance requires encryption using AES-128 or stronger, with AES-256 preferred, or RSA-2048 or stronger where applicable. Encryption applies to applicable storage such as:

• Databases
• Servers
• Storage
• Backups
• End-device storage

 

---

13. Encryption Key Management

Cryptographic keys should be managed separately from the data they protect.

Where applicable, we use a managed key-management system (“KMS”) or equivalent secure key-management mechanism.

Security controls may include:

• Secure key generation
• Restricted key access
• Key rotation
• Key revocation
• Key lifecycle management
• Separation of encryption keys from application data

Amazon's current security guidance requires a KMS or equivalent control covering the key lifecycle and recommends at least annual key rotation, with compromised keys revoked immediately.

---

14. Database Security

Production databases containing customer or marketplace information should be protected through:

• Authentication
• Access controls
• Encryption
• Network restrictions
• Restricted administrative access
• Monitoring
• Backups
• Appropriate retention controls

Databases should not be directly exposed to the public Internet unless specifically required and appropriately secured.

---

15. Cloud Infrastructure Security

Where cloud infrastructure is used, security controls may include:

• Private networking
• Firewall rules
• Security groups
• Network access controls
• IAM permissions
• Restricted administrative access
• Encryption
• Logging
• Monitoring
• Backup controls
• Vulnerability management

Cloud infrastructure should follow least-privilege principles.

---

16. Network Security

We use reasonable network-security controls appropriate to the architecture of the Service.

These may include:

• Firewalls
• Network access controls
• Security groups
• Restricted ports
• Private network segments
• Secure API gateways
• Rate limiting
• Traffic monitoring
• DDoS protections where available

Amazon's current SP-API best-practice documentation identifies network protection as a core security area for SP-API applications.

---

17. Environment Separation

Where technically applicable, we maintain separate:

• Development environment
• Testing/staging environment
• Production environment

Production customer data should not be copied into development environments unless there is a legitimate business/security reason and appropriate safeguards are implemented.

Where testing data is required, anonymized or synthetic data should be preferred.

---

18. Logging and Monitoring

We maintain appropriate logs to support:

• Security monitoring
• Troubleshooting
• Incident investigation
• API activity tracking
• Authentication monitoring
• Administrative activity
• System performance

Security logs should be protected against unauthorized modification or deletion.

Logs should contain only information reasonably necessary for their purpose.

Amazon's current best-practice documentation identifies logging and monitoring as a specific SP-API security area.

---

19. Security Log Retention

Security logs may be retained for a period appropriate to:

• Security investigations
• Fraud prevention
• System monitoring
• Compliance
• Legal requirements
• Marketplace requirements

For Amazon SP-API compliance, applicable security-log retention requirements will be implemented according to Amazon's current policies and guidance.

---

20. Monitoring and Alerting

Where appropriate, automated monitoring may be used to identify:

• Unusual login activity
• Repeated failed authentication
• Unusual API activity
• Excessive requests
• Unauthorized access attempts
• Security configuration changes
• Infrastructure failures
• Potential data-security incidents

Security alerts may be reviewed by authorized personnel.

---

21. Vulnerability Management

We maintain a process for identifying and addressing security vulnerabilities.

Depending on the system, this may include:

• Dependency monitoring
• Security updates
• Patch management
• Code review
• Vulnerability scanning
• Infrastructure review
• Security testing
• Remediation tracking

Critical vulnerabilities should be prioritized according to their severity and potential impact.

Amazon identifies vulnerability management as one of the core SP-API security best-practice areas.

---

22. Secure Software Development

AW Co-Pilot development should incorporate security considerations throughout the software development lifecycle.

This may include:

• Secure coding practices
• Code review
• Dependency management
• Secret scanning
• Input validation
• Authentication testing
• Authorization testing
• API security testing
• Vulnerability remediation
• Deployment controls

Secrets must not be hard-coded into application source code.

---

23. Source Code Security

AW Co-Pilot source code is treated as confidential business information.

Access is restricted to authorized development personnel.

We aim to prevent:

• Unauthorized copying
• Public repository exposure
• Credential leakage
• Unauthorized source-code distribution
• Unauthorized modification

Third-party developers or contractors may be subject to confidentiality and intellectual-property agreements.

---

24. Secrets Management

Sensitive information such as:

• API keys
• OAuth secrets
• Database passwords
• Encryption keys
• Cloud credentials
• Access tokens

should be stored using appropriate secrets-management mechanisms.

Credentials should not be stored in:

• Public Git repositories
• Front-end JavaScript
• Public documentation
• Screenshots
• Unsecured files
• Public cloud storage

Amazon specifically identifies protection of SP-API credentials as a security requirement.

---

25. Marketplace Access Controls

Each marketplace integration should use only the permissions necessary for the functionality provided.

AW Co-Pilot does not intentionally request marketplace permissions unrelated to its intended functionality.

Amazon's role system is designed to provide granular control over SP-API operations and resources.

---

26. Data Minimization

AW Co-Pilot follows a data-minimization approach.

We aim to:

• Request only required permissions.
• Retrieve only required data.
• Process only required information.
• Restrict internal access.
• Delete information when no longer required.

This is particularly important for Amazon information and PII.

---

27. Amazon PII Protection

If AW Co-Pilot receives Amazon PII through a restricted SP-API role, that information receives additional protection.

Controls may include:

• Encryption at rest
• Encryption in transit
• Restricted access
• Secure credential management
• Access logging
• Data retention controls
• Data deletion controls
• Incident response
• Secure backups

Amazon's current Key Security Control Guidance explicitly requires additional controls for PII.

---

28. Data Retention and Deletion

AW Co-Pilot maintains data-retention and deletion procedures.

Information is not intended to be retained indefinitely.

Our Data Deletion Policy describes the applicable deletion procedures.

For Amazon information, Amazon-specific retention requirements apply where applicable.

The current Amazon security guidance identifies specific controls for retention and recovery of Amazon information.

---

29. Backup Security

Backups are used to support:

• Disaster recovery
• Business continuity
• System restoration

Backups should be:

• Access-controlled
• Encrypted where appropriate
• Protected from unauthorized modification
• Subject to retention limits
• Included in applicable deletion procedures

Backups should not be publicly accessible.

---

30. Disaster Recovery

We maintain appropriate recovery procedures designed to restore critical services following:

• Infrastructure failure
• Security incidents
• Data corruption
• Cloud-service failures
• Other major operational disruptions

Recovery procedures may include:

• Backups
• Infrastructure restoration
• Database recovery
• Service redeployment
• Credential rotation
• Security validation

---

31. Incident Response

Ample Wings maintains an incident-response process for suspected security incidents.

An incident may include:

• Unauthorized access
• Credential compromise
• Malware
• Data exposure
• Data loss
• Unauthorized modification
• API abuse
• Account compromise
• Infrastructure compromise

Our response process may include:

1. Detection

Identify and validate the potential incident.

2. Containment

Limit further access or damage.

3. Investigation

Determine:

• What happened
• Which systems were affected
• Which data was involved
• When the incident occurred

4. Remediation

Remove the underlying vulnerability or compromised credentials.

5. Recovery

Restore affected services securely.

6. Notification

Notify customers, marketplace partners, regulators or other parties where required by applicable law or contractual obligations.

7. Review

Conduct a post-incident review and implement corrective measures.

Amazon's SP-API best-practice documentation specifically identifies incident response as a required security area for SP-API applications.

---

32. Amazon Security Incidents

If an incident involves Amazon information, we will follow applicable Amazon security and notification requirements.

Where required, we will:

• Investigate the incident
• Contain the incident
• Preserve relevant evidence
• Protect affected systems
• Notify Amazon where required
• Notify affected users where required
• Take corrective action

---

33. Employee and Contractor Security

Personnel who have access to confidential information are expected to:

• Maintain confidentiality
• Use authorized systems
• Follow security procedures
• Protect credentials
• Avoid unauthorized data copying
• Report suspected security incidents

Contractors and developers may be required to execute confidentiality and intellectual-property agreements before receiving access to confidential AW Co-Pilot information.

---

34. Termination of Access

When an employee, contractor or developer no longer requires access:

• Account access should be disabled.
• API credentials should be revoked where applicable.
• Cloud permissions should be removed.
• Repository access should be removed.
• Production access should be terminated.
• Other relevant credentials should be rotated where necessary.

---

35. Third-Party Service Providers

AW Co-Pilot may use third-party providers for:

• Cloud hosting
• Database services
• Storage
• AI processing
• Payment processing
• Email
• Analytics
• Monitoring
• Security

We seek to use providers that offer security measures appropriate to the services they provide.

Third-party providers may be subject to contractual requirements concerning confidentiality, security and data processing.

---

36. AI Security

AW Co-Pilot may process product data and user instructions through AI services.

Security measures may include:

• Restricted API credentials
• HTTPS/TLS
• Server-side API calls
• Access controls
• Input validation
• Output validation
• Provider-specific security controls
• Data minimization

Marketplace authentication credentials should not be provided to AI models as ordinary content-generation input.

---

37. AI-Generated Content Security

AI-generated content may be reviewed before being published to marketplaces.

Users remain responsible for reviewing generated:

• Product claims
• Descriptions
• Specifications
• Prices
• Images
• Compliance information

AI output should not be treated as inherently accurate or authoritative.

---

38. Payment Security

Payment information is handled using the security mechanisms of our payment providers.

AW Co-Pilot does not intentionally store complete payment-card information or CVV/security codes.

Payment providers may apply additional security requirements and controls.

---

39. Website Security

Our public websites should:

• Use HTTPS
• Maintain a valid SSL/TLS certificate
• Avoid insecure content
• Protect administrative access
• Use secure authentication
• Keep software dependencies updated
• Monitor for security issues

Amazon's public developer/service-provider website guidelines require HTTPS and a valid SSL certificate.

---

40. Security Testing

Where appropriate, we may conduct:

• Application security testing
• Vulnerability scanning
• Dependency scanning
• Infrastructure testing
• Access-control testing
• API security testing

Testing frequency may depend on:

• System changes
• Risk
• Infrastructure
• Regulatory requirements
• Marketplace requirements

---

41. Access Reviews

Access permissions may be reviewed periodically to identify:

• Unnecessary permissions
• Inactive accounts
• Excessive privileges
• Former employees/contractors
• Unused API credentials

Unnecessary access should be removed.

---

42. Security Training

Personnel who handle sensitive information may receive appropriate security guidance or training covering:

• Password security
• Phishing
• Credential protection
• Data handling
• Privacy
• Incident reporting
• Secure development
• Marketplace API requirements

---

43. Physical Security

Where Ample Wings or its service providers maintain physical infrastructure, appropriate physical security controls may be used by the relevant facility/provider.

Cloud infrastructure may rely on the physical-security controls of the applicable cloud provider.

---

44. Customer Responsibilities

Customers also have security responsibilities.

Customers should:

• Use strong passwords.
• Enable MFA where available.
• Protect account credentials.
• Avoid sharing accounts.
• Review connected marketplace permissions.
• Report suspicious activity.
• Use authorized devices.
• Avoid uploading unnecessary sensitive information.

Customers should immediately notify us if they believe their AW Co-Pilot account has been compromised.

---

45. Security Incident Reporting

To report a suspected security issue:

Email

support@amplewings.com

Subject

Security Incident – AW Co-Pilot

Please provide, where possible:

• Your name/company
• Account email
• Description of the issue
• Affected feature
• Approximate date/time
• Relevant screenshots or technical information

Do not send passwords, API secrets, private keys or authentication tokens in your security report.

---

46. Responsible Disclosure

We encourage responsible reporting of vulnerabilities affecting AW Co-Pilot.

Security researchers should:

• Avoid accessing data that does not belong to them.
• Avoid disrupting the Service.
• Avoid deleting or modifying customer information.
• Avoid publicly disclosing the vulnerability before we have had a reasonable opportunity to investigate.
• Avoid accessing or exporting marketplace PII.

We may provide additional responsible-disclosure instructions as our security program develops.

---

47. Compliance With Marketplace Requirements

AW Co-Pilot's security practices are designed to support applicable marketplace requirements.

For Amazon SP-API integrations, we maintain alignment with applicable:

• Amazon Data Protection Policy
• Amazon Acceptable Use Policy
• Solution Provider Agreement
• SP-API technical requirements
• Applicable role-specific requirements

---

48. Amazon Solution Provider Review

Where AW Co-Pilot requests restricted SP-API roles, Ample Wings understands that Amazon may perform additional security and architecture review.

Amazon states that restricted-role applications may undergo business, security and technical review, including review of the application's technical implementation and data-protection controls.

Our security documentation may therefore include:

• Data-flow diagrams
• Data classification
• Security architecture
• Access-control documentation
• Encryption architecture
• Data-retention procedures
• Data-deletion procedures
• Incident-response procedures
• Vulnerability-management procedures
• Infrastructure information

---

49. Security Documentation

Ample Wings may maintain internal security documentation including:

1. Security Policy
2. Data Protection Policy
3. Data Classification Policy
4. Data Retention Policy
5. Data Deletion Policy
6. Incident Response Plan
7. Access Control Policy
8. Vulnerability Management Policy
9. Backup and Recovery Procedure
10. API Credential Management Procedure
11. Architecture/Data Flow Diagram
12. Third-Party/Subprocessor Register

---

50. Changes to This Security Policy

We may update this Security Policy when:

• AW Co-Pilot architecture changes
• New marketplace integrations are added
• New security controls are implemented
• Technology changes
• Applicable laws change
• Marketplace requirements change
• Security risks change

The Last Updated date will be updated when material changes are made.

---

51. Contact Information

Ample Wings Overseas

4/284, Subhash Nagar
New Delhi, West Delhi
Delhi – 110027
India

Security / Privacy: support@amplewings.com
Sales: sales@amplewings.com
Phone / WhatsApp: +91 9318305286

---

Security Control Summary