Incident response plan

Version 1.0, adopted 14 October 2026. Reviewed at least every 6 months.

Scope

This plan covers any event that may expose Amazon Information or the credentials used to reach it: Selling Partner API keys and refresh tokens, Seller Central sign-in, the FBA Hub account, the Keepa key, and the computer FBA Hub runs on.

Examples:

• A failed sign-in or new device in the FBA Hub security log that was not the account holder.
• A lost or stolen computer or phone.
• Malware on the computer.
• A key pasted somewhere public.
• Amazon reporting unusual API use.

Roles

• Incident lead: the business owner, James Bachmeier. Decides when an incident has occurred, carries out the response and handles all notifications.
• Amazon security contact: security@amazon.com, for any incident involving Amazon Information.
• Outside help: Apple Support and a local IT professional for device recovery and malware removal, when needed.

Response steps

1. Detect. Check the FBA Hub security log for failed sign-ins, paused sign-ins and new devices. Watch for alerts from Amazon, Keepa, Apple and the browser.
2. Contain, within 1 hour of detection.
   • In FBA Hub → Settings, remove the Amazon store connection; this deletes the stored refresh token.
   • Revoke the extension access token and remove unknown devices.
   • In the Solution Provider Portal, rotate the app's LWA client secret and re-authorize the app to issue a new refresh token.
   • Change the Seller Central, FBA Hub and Keepa passwords, and regenerate the Keepa key.
   • Disconnect an affected computer from the network.
3. Notify Amazon, within 24 hours of detection. Email security@amazon.com about any incident that involves or may involve Amazon Information. Include:
   • what happened and when it was detected
   • what information or credentials may be affected
   • the steps taken so far
   • a contact for follow-up
   Send updates as more is learned.
4. Investigate. Work out how it happened from the security log, device history and account activity, and what was accessed.
5. Recover. Restore from a clean state, reconnect the store with new credentials, and confirm normal operation.
6. Learn. Within 2 weeks, write down the cause and the changes made so it does not recur, and update this plan.

Records

Each incident is recorded with:

• the detection time
• the time Amazon was notified
• the actions taken
• the outcome

Records are kept for at least 3 years.

Review

The incident lead reviews this plan at least every 6 months, and after any incident or significant change to how FBA Hub works. Each review is recorded in FBA Hub → Security.