Security & Incident Response Plan

Abdou Express, Calgary, Alberta, Canada · Incident Management Point of Contact (IMPOC): owner/operator, sales@abdouexpress.com. This plan covers all systems that access Amazon Selling Partner data used in our Amazon Account Management service. Approved by the owner (senior management); reviewed every six months and after any major infrastructure change. Last review: October 2026.

Incident types covered

Database compromise or hacking; unauthorized access to accounts, servers or SP-API credentials; data leaks or exfiltration of Amazon or customer information (including PII); malware; lost or stolen devices.

Response steps

Preparation – asset inventory (quarterly), MFA on all accounts, encrypted credential storage, centralized logs kept 12 months, current contact list for Amazon, affected sellers, hosting provider and authorities.
Detection & identification – alerts on failed logins, account lockouts, unusual SP-API call volume or access patterns, file-integrity and log anomalies; logs reviewed at least every two weeks. Every alert is investigated and recorded in the incident log with time, systems and data involved.
Containment – within hours of confirmation: isolate affected server/database from the network, disable compromised user accounts and sessions, revoke and rotate SP-API refresh tokens, client secrets and passwords, block attacker IPs at the firewall, preserve logs and disk images as evidence.
Notification – notify Amazon at security@amazon.com within 24 hours of detection (what happened, data and sellers affected, actions taken). Notify affected sellers promptly, and government authorities (e.g. Office of the Privacy Commissioner of Canada under PIPEDA) where required by law.
Eradication – find root cause; remove malware/backdoors and unauthorized accounts; patch the exploited vulnerability (critical within 7 days, high within 30 days); rebuild from clean images where integrity is uncertain.
Recovery – restore from verified clean, encrypted backups; re-issue new credentials; return systems to service only after vulnerability scan; heightened monitoring for 30 days.
Post-incident review – written lessons-learned report within 14 days; update this plan, controls and training; provide follow-up to Amazon and affected sellers as requested.
Testing – the plan is tested at least annually through a tabletop exercise; backup restores are tested quarterly.

Supporting controls

Area	Control
Data retention	Amazon customer PII is used only to fulfill orders and support carrier claims, and is deleted within 30 days after order delivery unless law requires longer (then stored encrypted). Non-PII is kept only as long as needed, with the reason documented. All data is securely deleted (NIST 800-88) within 30 days of a seller revoking access or on Amazon's request.
Encryption	TLS 1.2+ for all data in transit (HTTPS, SSH-2/SFTP). AES-256 encryption at rest for databases, backups and SP-API credentials; keys rotated annually.
Credentials & access	Unique accounts, no shared logins, least privilege, MFA, 12+ character passwords, lockout after 10 failed attempts. SP-API keys are never in source code or plain text and are rotated annually or immediately if compromise is suspected. Access removed within 24 hours of a role change; access reviewed quarterly.
Network protection	Firewall default-deny, only required ports exposed, admin access restricted by IP and SSH keys, anti-malware updated monthly, monthly vulnerability scans, annual penetration test.
Logging	Security logs (no PII) kept at least 12 months, with access controls to protect integrity.

Questions or to report a security concern: sales@abdouexpress.com. See also: Amazon Account Management · Privacy Policy.