1. Scope
This page describes the security program of Logivault LLC (Logi-Vault) for the systems that store or process client business data, shipment recipient personal information and information obtained through Amazon's Selling Partner API ("Amazon Information"). It reflects the requirements of Amazon's Data Protection Policy and Acceptable Use Policy. The controls marked for personal information are in place before we access any Amazon buyer personal information and for as long as we hold it.
2. Principles
- Need to know: we request only the Amazon roles and data required for the service a seller has engaged us for.
- Purpose limitation: Amazon Information is used only to provide services to the seller it belongs to, never for marketing, resale or any other purpose.
- Separation: every record in our warehouse system is tied to the client it belongs to; clients can see only their own data.
- Minimization: personal information is kept only as long as needed and then deleted (see section 10).
3. Network and infrastructure
- Systems run on a dedicated, hardened server. Only HTTPS is exposed to the internet, through a reverse proxy with automatically renewed TLS certificates.
- Application services and databases listen only on the local machine and are not reachable from the internet.
- A host firewall blocks all inbound traffic except required ports; anti-malware protection is enabled and operating system updates are applied regularly.
- Remote administration is restricted and protected by multi-factor authentication.
4. Access control
- Every person has an individual account; shared accounts are not used.
- Access follows least privilege and role-based permissions (administrator, manager, operator, client). Access to personal information is limited to staff who need it to ship orders or support the client.
- Multi-factor authentication is required for administrative access and for any access to systems holding personal information.
- Access is reviewed at least every 90 days and removed within 24 hours when someone leaves or changes role.
- Passwords must be at least 12 characters, unique, and are stored only as salted hashes.
5. Encryption
- In transit: all connections to our website, portal, APIs and to Amazon use TLS 1.2 or higher.
- At rest: personal information is encrypted using AES-256 (or equivalent) at the field, database or disk level.
- Backups: backups are encrypted before they leave the server and are stored with access restricted to administrators.
6. Credentials and secrets
- API keys, Login with Amazon credentials and refresh tokens are stored in protected configuration on the server, readable only by the service account that needs them, and never in source code or code repositories.
- Source code is scanned for accidentally committed secrets, and any exposed credential is rotated immediately.
- Refresh tokens for a seller are deleted when the seller revokes authorization or ends the relationship.
7. Logging and monitoring
- Access to systems and data, administrative actions and security events are logged. Logs do not contain Amazon buyer personal information.
- Logs are kept for at least 90 days and protected from modification.
- Alerts are configured for suspicious activity, failed sign-ins and service failures, and are tested periodically.
- Inventory changes in our warehouse system are recorded in an append-only ledger, so every stock movement can be audited.
8. Vulnerability management
- Security patches are applied promptly; critical patches as soon as practicable.
- Vulnerability scans of internet-facing systems run at least every 30 days, and findings are fixed according to severity.
- An independent penetration test is performed at least every 12 months, and after major changes, for systems that hold personal information.
9. Incident response
- We maintain a written incident response plan covering detection, containment, investigation, recovery and lessons learned. It is reviewed at least every six months.
- If a security incident involves Amazon Information, we notify Amazon at security@amazon.com within 24 hours of detecting it.
- Affected clients are notified without undue delay, and regulators and individuals as required by law.
- Credentials that may be affected are revoked and rotated as part of containment.
10. Retention and deletion
- Amazon buyer personal information is deleted within 30 days after order delivery, unless a longer period is required by law (for example tax records), in which case it remains encrypted and is used only for that purpose.
- Encrypted backups expire within 30 days, so deleted personal information does not persist in backups beyond that period.
- When a seller revokes access or ends the relationship, we stop accessing their Amazon account and, on request, delete their Amazon Information within 30 days, except records we must keep by law.
- Non-personal business data (inventory, sales and report history) is kept for the relationship or as the client instructs.
11. People and training
- Staff with access to client or Amazon data receive security and privacy training when they start and at least once a year.
- Staff are bound by confidentiality obligations.
- Printed documents containing personal information (such as packing slips) are kept in controlled warehouse areas and shredded when no longer needed.
12. Reporting a security issue
If you believe you have found a security vulnerability or that data has been exposed, email ops@thelogivault.com with "Security" in the subject. We acknowledge reports within one business day.
Logivault LLC (doing business as Logi-Vault)
Greenville, South Carolina, USA
Email: ops@thelogivault.com
Phone: +1 (813) 761-0134
Hours: Monday–Friday, 8 AM–6 PM Eastern