.svg)
Restricted PII access granted & audited
Approved by Amazon to pull customer addresses and gift messages for sellers who enable the PII add-on.
We take security seriously. Every byte of your Amazon data lives behind a top-grade security layer, reviewed by Amazon itself under its strictest data protection process.
Approved by Amazon to pull customer addresses and gift messages for sellers who enable the PII add-on.
Every database row, every cached file, every backup encrypted with AES-256-GCM — the authenticated cipher used by the U.S. government for classified data.
Continuously monitored cipher suites. Weak protocols refused. Every API call, every dashboard session, every Amazon connection.
Encryption, retention, key rotation, vulnerability management and incident response — all audited by Amazon under the Public PII Process.
External pen tests on data-flow components, scheduled on annual cycle. Reports archived; findings remediated and re-verified.
Continuous monitoring for unusual access patterns and emerging vulnerabilities, with scheduled deep scans across all components.
Your DataDoe data lives on AWS and GCP infrastructure in the United States (Tier-3+ datacenters) — physically isolated, redundantly powered, continuously monitored. Every customer organization gets its own logically separated data partition. US by default; EU data residency available on Enterprise.
Isolation isn't only an app setting. It's enforced in the database itself: each organization's data sits in its own partition, and nothing in one organization can reach another's.
Three layers protect your data across its entire lifecycle in DataDoe — applied automatically, enforced everywhere, monitored continuously.
Every database row, every cached file, every backup — encrypted with AES-256-GCM, the authenticated cipher used by the U.S. government for top-secret data classification.
Every API call, every dashboard session, every Amazon connection. We continuously monitor cipher suites and refuse weak protocols. No exceptions, no downgrade attacks.
Your Amazon connection credentials, API keys, and database secrets live in AWS Secrets Manager — separated from data, rotated on cycle, never hardcoded in source. Continuous monitoring flags any unusual access.
To pull customer addresses, customizations and personal data from Amazon SP-API, every organization must complete the Public PII Process — a months-long, multi-stage audit covering encryption, retention, access controls, vulnerability management and incident response. Here's exactly what was reviewed.
| Control | What was reviewed |
|---|---|
| Restricted Data Token (RDT) infrastructure | Every PII request short-lived, scoped per resource |
| AES-256-GCM encryption at rest | Every byte of customer data, including all backups |
| TLS 1.3 encryption in transit | Continuous monitoring · weak ciphers refused |
| Encryption key rotation | AWS Secrets Manager · separated from data store |
| 30-day PII retention enforcement | Lifecycle automation · audit trail required |
| Penetration testing program | Third-party security firm · annual cycle · reports on file |
| Continuous vulnerability monitoring | Automated scans · scheduled deep scans across components |
| Least privilege access policy | Engineers see only systems they directly maintain |
| Quarterly access reviews | All employee accounts · access revoked within 24 hours of termination |
| Incident response plan | Documented procedure · regular tabletop exercises |
| 48-hour breach notification SLA | Tighter than 72-hour GDPR default |
| Access and activity logging | API and MCP requests logged · every access change recorded |
Binding contractual terms in DPA · Subprocessor list in Annex C · Full Trust Center at /legal
How DataDoe handles your data when you use AI features inside the platform — and when you connect your own AI tool through MCP or the REST API.
When you use in-product AI features in the DataDoe app, we send only the minimum data the model needs to answer your specific question. Never your full warehouse.
When you connect Claude, Cursor, Codex, ChatGPT or any AI tool through MCP or our REST API, the tool requests what it needs and we send only that. Your Admins decide which Amazon accounts, Actions and data tables each person and each key can use, and whether they can see buyer data.
Not by us. Not by the AI providers we connect to, when configured properly through their enterprise plans — which we recommend and document for every supported provider.
Every user account, every API key, every connection.
Every user can set up 2FA with any TOTP authenticator app, such as Google Authenticator, Authy or 1Password. Admins can require 2FA for everyone signing in to the DataDoe app. MFA is enforced for all DataDoe staff with infrastructure access.
Every API and MCP key is generated, shown to you a single time, then permanently hidden — even from us. Lose it, you regenerate.
Give each person and each key only the Amazon accounts, Actions and data they need. Buyer data needs its own permission, and every Amazon account stays read-only until you switch it to read and write.
Clear retention rules. No surprises. No "we keep it for analytics purposes" small print.
Encrypted at rest, accessible via dashboard, API, MCP and BigQuery.
Sync from Amazon stops. No new data added. Your existing data marked for deletion.
All your data — including backups — permanently removed from our systems, verified by audit log.
Customer names and addresses from Amazon orders are auto-deleted no later than 30 days after delivery — separate from your subscription lifecycle, in line with Amazon's SP-API Data Protection Policy.
Request immediate full deletion via dashboard or email. Completed and confirmed within 24 hours, audit-logged. Plus: export your full historical dataset in CSV or JSON before you go — no lock-in, ever.
If a confirmed security incident affects your data, we notify you within 48 hours of confirmed awareness — tighter than the 72-hour GDPR default — with the information you need to meet your own notification obligations.
In Tier-3+ cloud datacenters in the United States by default; EU data residency is available on Enterprise. Every customer organization gets its own logically isolated data partition. We don't replicate your data to other regions and we don't move it offshore.
Almost no one. We operate on least-privilege by default — engineers can only access systems they directly maintain, every read is audit-logged, and access to anything containing customer PII requires a documented reason and is reviewed quarterly. Support staff never see raw PII unless you explicitly grant temporary access to debug an issue.
Yes. We completed Amazon's Public PII Process — the audit required to access restricted SP-API data such as customer addresses, personal data and product customizations. Encryption, retention, key rotation, vulnerability management and incident response were all reviewed and approved by Amazon. Approval is renewed annually.
Yes. Admins give each person and each integration key a role that limits them to selected Amazon accounts, Actions and data tables. Buyer names and addresses need a separate permission, even for someone with access to everything else. Every change to roles and access is recorded with who made it, in Settings → Usage.
It's automatically deleted, full stop. Amazon's policy requires PII to be purged within thirty days of order delivery unless there's a legal basis to keep it longer (for example, tax records). Our pipeline enforces this automatically — the deletion job runs nightly and writes a record into your audit log every time it runs.
No. Your data is never used to train any model — ours, or anyone else's. When you use AI features inside DataDoe, we send only the minimum data needed to answer your specific question, and we route through enterprise-tier AI provider plans that contractually exclude your prompts and responses from model training.
We have a documented incident response plan and run tabletop exercises against it twice a year. If a breach affecting your data is detected, we notify you within forty-eight hours with what was accessed, what wasn't, what we've done to contain it, and what you need to do on your side. The same plan covers regulatory notifications where required.
We follow the controls required by each framework, and we hold Amazon's Public PII approval. We're happy to share our security questionnaire response, test summary, sub-processor list and DPA on request — most security teams accept this package.
Sync stops the moment you cancel. Within thirty days, all your data — including encrypted backups — is permanently removed from our systems and the deletion is verified by audit log. If you need it gone faster, request immediate deletion via the dashboard or email and we complete it within twenty-four hours, with written confirmation.
Email contact@datadoe.com or ask your account contact. Most teams receive it within one business day.
We'll walk you through our security setup, share our security documentation pack, or answer your security team's questions. Just reach out.
Book a demoEvery Amazon account starts read-only. Connect in about 5 minutes, free for 14 days, or book a call and we will walk your security team through the setup.
We use cookies to improve your experience and analyze traffic. By clicking "Accept", you agree to our use of cookies. Read the Cookie Policy.