Security

Atlantic is built for Amazon sellers who need automation they can trust. Our security work focuses on protecting seller data, Amazon authorization, production systems and the workflows that act on your behalf.

Amazon OAuth

Sellers connect Atlantic through Amazon OAuth. Atlantic never asks for, receives or stores Amazon account passwords.

Encrypted Refresh Tokens

Amazon SP-API refresh tokens are encrypted before they are stored. Tokens are decrypted only when Atlantic needs to request a short-lived Amazon access token for an authorized workflow.

HTTPS

Atlantic is served over HTTPS in production. Browser sessions use HTTP-only cookies so client-side scripts cannot read session tokens.

Session Protection

Atlantic sessions are signed, time-limited and stored in secure browser cookies. Signing out ends the Atlantic session without revoking your Amazon authorization.

Least Privilege

Atlantic requests and uses access only for the Amazon workflows it provides. Internal access to production systems is limited to operational needs.

Security Monitoring

Production logging focuses on operational signals such as sync status, job counts and failures. Sensitive values such as OAuth codes, tokens, cookies and secrets are redacted from logs.

Beta Security Expectations

Atlantic is operated carefully during beta, but beta software may still contain defects. Sellers should continue monitoring Seller Central and report anything unexpected right away.

Responsible Disclosure

If you believe you have found a vulnerability, email support@atlanticengine.dev with "Security" in the subject line. Please include enough detail for us to reproduce and investigate safely.