Security and vulnerability disclosure

Report a vulnerability

If you find a security vulnerability or suspect unauthorized access to or misuse of Amazon Advertising data processed by our platform, email info@baoks.de with a description, steps to reproduce if applicable, and how to reach you.

How we respond

1. We acknowledge every report within 24 hours and assess severity and scope within 48 hours.
2. We fix confirmed vulnerabilities as quickly as possible, prioritizing issues that affect the security or integrity of Amazon Advertising data.
3. If an incident involves actual or suspected unauthorized access to, disclosure of, or misuse of Amazon Data, we notify Amazon within 24 hours of detection (Amazon Ads API Data Protection Policy) and coordinate further notifications with Amazon, except where the law requires us to notify affected users or authorities directly (e.g. GDPR Art. 33/34).
4. Our internal incident response plan defines roles, incident types, and the escalation path to Amazon; it is reviewed at least every six months and after major infrastructure changes.

Data security measures

• Amazon Ads API refresh tokens are encrypted at rest using AES-256-GCM.
• Access to Amazon Data is restricted on a need-to-know basis.
• Public pages use only cookies and local storage that are strictly necessary or that you request (for example sign-in and display preferences).
• Application, database and authentication infrastructure runs on contracted hosting providers listed in our Data Processing Agreement; the AI assistant worker runs on company-managed, full-disk-encrypted hardware and reaches customer data only through the authenticated agent API.
• We review access patterns, audit logs, and API usage to detect anomalies.
• Upon termination of the account or receipt of a deletion request, we immediately discontinue all processing and syncing of Amazon Data. Amazon Data in active production systems is deleted without undue delay. Residual encrypted backup copies are deleted automatically within a maximum of 30 days.

Scope

This policy covers all Amazon Advertising data processed through Holy Quack, including campaign, keyword, search term and performance data obtained via the Amazon Ads API.