We take security seriously. Every byte of your Amazon data lives behind top-grade security layer, audited by Amazon itself under their hardest data protection process.
Pre-approved by Amazon to pull customer addresses, customizations and gift messages on behalf of every connected seller.
Every database row, every cached file, every backup encrypted with AES-256-GCM — the authenticated cipher used by the U.S. government for classified data.
Continuously monitored cipher suites. Weak protocols refused. Every API call, every dashboard session, every Amazon connection.
Encryption, retention, key rotation, vulnerability management and incident response — all audited by Amazon under the Public PII Process.
External pen tests on data-flow components, scheduled on annual cycle. Reports archived; findings remediated and re-verified.
Continuous monitoring for unusual access patterns and emerging vulnerabilities, with scheduled deep scans across all components.
Your DataDoe data lives on AWS and GCP infrastructure in the United States (Tier-3+ datacenters, primary region Northern Virginia, us-east-1) — physically isolated, redundantly powered, continuously monitored. Every customer organization gets its own logically separated data partition.
This isn't a permission setting we could accidentally turn off. It's how the database is architected: cross-organization access is impossible by design, not just disallowed. You see your data. Nothing else, ever.
Three independent encryption layers protect your data across its entire lifecycle in DataDoe — applied automatically, enforced everywhere, monitored continuously.
Every database row, every cached file, every backup — encrypted with AES-256-GCM, the authenticated cipher used by the U.S. government for top-secret data classification.
Every API call, every dashboard session, every Amazon connection. We continuously monitor cipher suites and refuse weak protocols. No exceptions, no downgrade attacks.
Your Amazon connection credentials, API keys, and database secrets live in AWS Secrets Manager — separated from data, rotated on cycle, never hardcoded in source. Continuous monitoring flags any unusual access.
To pull customer addresses, customizations and personal data from Amazon SP-API, every organization must complete the Public PII Process — a months-long, multi-stage audit covering encryption, retention, access controls, vulnerability management and incident response. Here's exactly what was reviewed.
How DataDoe handles your data when you use AI features inside the platform — and when you connect your own AI tool through MCP, REST API, or SDK.
When you use AI features inside the DataDoe app — daily briefs, ask-anything chat, suggested actions — we send only the minimum data the model needs to answer your specific question. Never your full warehouse.
When you connect Claude, Cursor, Codex, ChatGPT or any AI tool through MCP or our REST API, the tool requests what it needs and we send only that. You set the scope. You see every call. You revoke access in one click.
Not by us. Not by the AI providers we connect to, when configured properly through their enterprise plans — which we recommend and document for every supported provider.
Every user account, every API key, every integration.
Every user can set up 2FA with any TOTP authenticator app — Google Authenticator, Authy, 1Password, hardware keys. MFA is enforced for all DataDoe staff with infrastructure access.
Every API and MCP key is generated, shown to you a single time, then permanently hidden — even from us. Lose it, you regenerate.
Every team member gets a scoped role. Every integration gets the narrowest permissions needed. Quarterly access reviews across all employee accounts.
Clear retention rules. No surprises. No "we keep it for analytics purposes" small print.
Encrypted at rest, accessible via dashboard, API, MCP, SDK and BigQuery.
Sync from Amazon stops. No new data added. Your existing data marked for deletion.
All your data — including backups — permanently removed from our systems, verified by audit log.
Customer names and addresses from Amazon orders are auto-deleted no later than 30 days after delivery — separate from your subscription lifecycle, in line with Amazon's SP-API Data Protection Policy.
Request immediate full deletion via dashboard or email. Completed and confirmed within 24 hours, audit-logged. Plus: export your full historical dataset in CSV or JSON before you go — no lock-in, ever.
If a confirmed security incident affects your data, we notify you within 48 hours of confirmed awareness — tighter than the 72-hour GDPR default — with the information you need to meet your own notification obligations.
We'll walk you through our security setup, share compliance docs, or answer your security team's questions. Just reach out.
Every integration. Full onboarding support. If it’s not the best decision you made in 2026, you can cancel anytime.
We use cookies to improve your experience and analyze traffic. By clicking "Accept", you agree to our use of cookies. Read the Cookie Policy.
