Security & incident response

1. How Amazon Ads data is protected

• Network controls. The server's firewall denies all inbound traffic by default. Only HTTPS and one non-standard, rate-limited administrative port are open. The database and internal services listen only on the server itself and are additionally blocked at the firewall. Repeated failed log-ins are blocked automatically.
• Encryption in transit. The site is served over HTTPS only (TLS 1.2 and 1.3, HTTP Strict Transport Security). Every call to Amazon's APIs is made over HTTPS.
• Credentials encrypted at rest. Amazon access tokens and third-party API secrets are stored encrypted (AES-256-GCM). The key is held only in server configuration readable by the service account, never in source code.
• Customer isolation. Every database table enforces row-level security, and every data request must be authenticated. Isolation is verified with forged-credential tests: one customer cannot read another customer's data.
• Least privilege. The application runs as an unprivileged service account. Administrative access to servers, databases and Amazon credentials is limited to the owner. Administrative functions in the product are restricted to named administrator accounts.
• No card data on our servers. Payments are taken by Stripe's hosted checkout; card numbers never reach AcosControl.
• Patching and backups. Operating-system security updates install automatically. Backups are readable by the owner only and are never stored in a web-accessible location.
• No resale or sharing. Amazon Ads data is never sold or shared. It is sent only where a customer directs it for their own account (their own alert channel), and a monthly ad-spend total goes to our payment processor solely to calculate that customer's usage fee.

2. Incident response plan

A security incident is any actual or reasonably suspected unauthorised access to, use, disclosure, alteration or loss of customer data or Amazon information, or any compromise of the systems or credentials that protect it.

Roles

Incident leadThe owner of CANDIMA Inc. leads every incident end to end: triage, containment, notification and review. Outside specialists (hosting provider, security consultants) are engaged as needed and act under the lead's direction.

Monitoring & detection

• Automated checks on the data feeds and scheduled jobs, with alerts sent to the incident lead.
• Firewall and brute-force protection logs; blocked access attempts are recorded.
• Application and server error logs, including rejected authentication and forged-signature attempts on payment webhooks.
• Alerts from providers (Amazon, Stripe, the hosting provider) and reports from customers or researchers via support@acoscontrol.com.

Response steps

1. Triage (within 1 hour of detection). Confirm what happened, which systems and which customers' data may be affected, and assign a severity: High (Amazon information or customer data exposed or at risk), Medium (a control failed without evidence of exposure), Low (attempt blocked).
2. Contain. Revoke or rotate any affected credentials (Amazon tokens, API keys, service secrets), block the source, and take affected components offline if needed. Preserve logs and evidence before changing anything that would erase them.
3. Eradicate & recover. Remove the cause, patch the weakness, restore from clean backups where needed, and verify the fix before returning to normal service.
4. Notify. For any incident involving Amazon information, report it to Amazon at security@amazon.com within 24 hours of confirming it, and cooperate with Amazon's investigation. Notify affected customers without undue delay (and within 72 hours where the law requires it), and regulators where required.
5. Review (within 14 days). Write up the root cause, timeline, impact and actions taken; update controls and this plan so the same failure cannot recur.

Records & testing

Every incident, however small, is logged with its timeline and outcome. This plan is reviewed and exercised at least once a year and after every incident.

3. Password & credential standard

4. Reporting a security issue

If you believe you have found a vulnerability or that data has been exposed, email support@acoscontrol.com with “Security” in the subject. We acknowledge reports within one business day and will keep you informed while we investigate.