Security

Security & Vulnerability Disclosure

Last updated: August 17, 2026

Reporting a Security Vulnerability

If you discover a security vulnerability or suspect unauthorized access to or misuse of Amazon Advertising data processed by our platform, please report it immediately.

Security contact: info@baoks.de

Please include:

  • A description of the vulnerability or incident
  • Steps to reproduce, if applicable
  • Your contact information for follow-up

Our Response Process

  1. We acknowledge receipt of all security reports within 24 hours.
  2. We assess the severity and scope of the reported issue within 48 hours.
  3. We work to resolve confirmed vulnerabilities as quickly as possible, prioritizing issues that affect the security or integrity of Amazon Advertising data.
  4. If an incident involves the actual or suspected unauthorized access to, disclosure of, or misuse of Amazon Data, we notify Amazon within 24 hours of detection (Amazon Ads API Data Protection Policy) and coordinate any further notifications with Amazon, except where the law requires us to notify affected users or authorities directly (e.g. GDPR Art. 33/34).
  5. Our internal incident response plan defines roles, incident types, and the escalation path to Amazon; it is reviewed at least every six months and after major infrastructure changes.

Data Security Measures

  • Amazon Ads API refresh tokens are encrypted at rest using AES-256-GCM.
  • Access to Amazon Data is restricted on a need-to-know basis.
  • We use only essential cookies for authentication and session management.
  • Application, database, and authentication infrastructure is operated on professionally managed cloud platforms with industry-standard security controls.
  • We review access patterns, audit logs, and API usage to detect anomalies.
  • Upon termination of the account or receipt of a deletion request, we immediately discontinue all processing and syncing of Amazon Data. Amazon Data in active production systems is deleted without undue delay. Residual encrypted backup copies are deleted automatically within a maximum of 30 days.

Scope

This policy covers all Amazon Advertising data processed through our bid optimization platform, including campaign data, keyword data, search term data, performance metrics, and other data obtained via the Amazon Ads API.