Security Practices

1. Data Encryption

In Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS). This prevents eavesdropping and man-in-the-middle attacks.

At Rest

Data stored in our database is encrypted at rest using AES-256 encryption. This includes advertising campaign data, order and fee data from SP-API, catalog information, review solicitation history, user preferences, and API tokens for both the Advertising API and SP-API.

2. API Token Handling

RedHen Labs uses two separate OAuth integrations — one for the Amazon Advertising API and one for the Selling Partner API. Each produces its own set of tokens, handled with extreme care:

• Ads API tokens: OAuth via Login with Amazon (LWA) — scoped to advertising data only
• SP-API tokens: OAuth via Seller Central — scoped to orders, fees, catalog, and solicitations
• All tokens are encrypted before storage
• We never store your Amazon login credentials
• Tokens are scoped to only the permissions required by each API
• Refresh tokens are rotated according to Amazon's security guidelines
• Tokens are immediately invalidated when you disconnect either account
• Disconnecting one API does not affect the other — each can be revoked independently

API secrets are never exposed in client-side code or logs.

3. User Data Isolation

Each user's data is strictly isolated from other users:

• No Direct Database Access: The database cannot be reached from a browser; only our backend can query it, and row-level security stays enabled on every table as a backstop
• Tenant Isolation: Every query is scoped to the account the request acts for
• No Cross-User Data Access: No user can view another user’s advertising, order, or seller data unless that account’s owner gives them access, for example our team under Managed or an agency the owner chooses

Your data is never shared with or visible to other RedHen Labs users unless you give them access to your account.

4. Authentication & Access Control

• Secure password hashing using industry-standard algorithms
• Session tokens with automatic expiration
• Protection against brute-force attacks
• Secure password reset flows
• Optional session timeout for inactive users

5. Infrastructure Security

Our infrastructure is built on trusted cloud providers with enterprise-grade security:

• Supabase: SOC 2 Type II compliant database hosting
• Stripe: PCI DSS Level 1 certified payment processing
• Anthropic: AI features. When you use one — bid recommendations, Sponsored Display bid recommendations, search-term harvesting, negative keyword suggestions, placement adjustments, or the assistant — the Amazon data relevant to that request leaves our platform and is sent to the Anthropic API to generate the response. Anthropic processes it to return a result and does not use it to train its models. No buyer names, addresses, email addresses, phone numbers or payment details are included, because we do not store them. If you never use an AI feature, no data is sent to Anthropic.
• Regular security patches and updates
• DDoS protection
• Automated backups with encryption

6. Application Security

• Input validation and sanitization to prevent injection attacks
• Protection against Cross-Site Scripting (XSS)
• Protection against Cross-Site Request Forgery (CSRF)
• Secure HTTP headers
• No sensitive data in URLs or logs

7. Monitoring & Incident Response

• Continuous monitoring for suspicious activity
• Automated alerts for security anomalies
• Incident response procedures in place
• Regular security reviews

In the event of a security incident affecting your data, we will notify you promptly in accordance with applicable laws and regulations.

8. Your Security Responsibilities

To help keep your account secure, we recommend:

• Using a strong, unique password for your RedHen Labs account
• Not sharing your login credentials
• Logging out when using shared devices
• Keeping your email account secure (used for password resets)
• Reviewing your connected Amazon Advertising and Seller Central accounts periodically
• Disconnecting API integrations you no longer use

9. Reporting Security and Privacy Issues

If you find a security vulnerability in RedHen Labs, have a concern about how we handle data, or believe someone is misusing Amazon data obtained through RedHen Labs, email contact@rrw-ads.com with “Security report” in the subject line.

What to include

• What you found and where: the page, feature or address involved
• The steps that reproduce it
• The impact you believe it has
• How we can reach you with questions and updates

Please include no more customer data than you need to show the problem.

What happens after you report

1. Within 24 hours, we confirm we received your report and give it a reference number. We track the report under that number until it is resolved; please use it in any follow-up.
2. Within 48 hours, we tell you how serious we judge the problem and what happens next.
3. We fix confirmed problems in order of severity, on the timelines our vulnerability management policy sets.
4. We update you at least every 7 days until the problem is resolved, and tell you when the fix is live.

If a report shows that customer data or Amazon data was exposed, we follow our incident response plan. That includes notifying Amazon within 24 hours and notifying affected customers as the law requires.

Testing guidelines

• Test only with your own account. Don’t view, change or delete anyone else’s data; if you reach it by accident, stop, keep no copy, and tell us.
• No denial-of-service testing, spam, social engineering or physical attempts.
• Give us a reasonable time to fix a problem before you disclose it publicly.

This covers rrw-ads.com, app.redhenlabs.com, api.rrw-ads.com and redhenlabs.com. A problem in Amazon’s, Stripe’s, Supabase’s or another provider’s own systems should be reported to that provider.

Safe harbor

If you research and report a problem in good faith and follow the testing guidelines above, we consider your research authorized, and:

• We will not bring or support legal action against you for that research, or for an accidental, good-faith breach of this policy, including under anti-hacking laws such as the Computer Fraud and Abuse Act or anti-circumvention laws such as the Digital Millennium Copyright Act.
• We waive, for that research only, the parts of our Terms of Service that would otherwise forbid it, such as the rules against reverse engineering the Service or interfering with its security.
• If anyone else takes legal action against you over research that followed this policy, we will make it known that you acted in line with it.

The safe harbor covers only systems RedHen Labs controls, the hosts listed above. We can’t give permission on behalf of Amazon, Stripe, Supabase or any other provider, and you remain responsible for following the law. If you’re unsure whether something you plan to do is covered, ask us at contact@rrw-ads.com before you do it.

We thank everyone who reports a problem. We don’t run a paid bug bounty. The same contact is published in machine-readable form at /.well-known/security.txt.

10. Contact Us

For security-related questions, email contact@rrw-ads.com.

AS Milling & Woodworks LLC
dba RedHen Labs
89 East Adamsdale Road
Orwigsburg, PA 17961