Amazon Data Protection & Handling Policy
Network Protection & Access Management
- All Purely Outdoors servers have active network protection controls using a network firewall to deny access to unauthorized IP addresses and AES-256 encryption. All public access is denied.
- A unique ID/Key/Authentication is assigned to each Purely Outdoors developer to control and monitor computer access to Amazon Information and developers cannot create or use generic, shared, default login credentials or user accounts. All access/authorization is controlled by Purely Outdoors Management.
- Purely Outdoors developers have active baseline mechanisms to ensure that at all times only the required user accounts can access Amazon Information.
- Purely Outdoors solely reviews the authorized list of people and services with access to Amazon Information on a monthly basis, and removes accounts that no longer require access.
- Purely Outdoors employees are restricted from storing Amazon data on personal devices.
- Purely Outdoors developers maintain and enforce "account lockout" by detecting anomalous usage patterns, log-in attempts and disables accounts with access to Amazon Information as needed.
- Purely Outdoors developers use HTTPS encryption for all Amazon Information in transit within, but not limited to our network or between hosts.
- Purely Outdoors developers enforce this security control on all applicable external endpoints used in internal communication channels including, but not limited to data propagation channels among storage layer nodes, connections to external dependencies and operational tooling.
- Purely Outdoors developers disable communication channels which do not provide encryption in transit even if unused, including, but not limited to removing the related dead code, configuring dependencies only with encrypted channels, and restricting access credentials to the use of encrypted channels.
- Purely Outdoors developers use AWS Encryption SDK where channel encryption using TLS terminates in untrusted multi-tenant hardware such as untrusted proxies.
- Purely Outdoors maintain an incident response plan to deal with an interruption to, or degradation of, a service or component. Developers review and verify the plan every six months and after any major infrastructure or system change, and will inform Amazon via email to 3p-security@amazon.com within 24 hours of detecting any Security Incidents.
Additional Security Requirement Specific to Personally Identifiable Information
Data Retention & Recovery
Purely Outdoors developers retain Personally Identifiable Information (PII) only for the purpose of, and as long as is necessary to fulfil orders, but no longer than 30 days after order shipment or to calculate/remit taxes. If an Purely Outdoors developer is required by law to retain archival copies of PII for tax or similar regulatory purposes, this archived Amazon Information is stored as a "cold" or offline and is not available for immediate or interactive use. All backup is stored in a physically secure facility, and all archived data on backup media is encrypted. In the event that PII is lost, Purely Outdoors will be able to recover all lost Personally Identifiable Information.
Data Governance
Purely Outdoors developers create, document, and abide by the Purely Outdoors privacy and data handling policy for their applications or services which govern the appropriate conduct and technical controls to be applied in managing and protecting information assets.
Purely Outdoors developers keep inventory of software and physical assets such as, but not limited to computers and mobile device with access to PII, and update regularly. A record of data processing activities such as specific data fields and how they are collected, processed, stored, used, shared, and disposed for all PII Information is maintained to establish accountability and compliance with regulations.
Purely Outdoors developers have established and abide by the Purely Outdoors privacy policy for customer consent and data rights to access, rectify, erase, or stop sharing/processing their information where applicable or required by data privacy regulation.
Encryption & Storage
Purely Outdoors developers encrypt all Amazon Information in transit using HTTPS and encrypt all PII at rest including, but not limited to, when the data is persisted, using industry best practice standards by using AES-256. All cryptographic materials including, but not limited to encryption/decryption keys and cryptographic capabilities, daemons implementing virtual Trusted Platform Modules and providing encryption/decryption APIs used for encryption of PII at rest are only accessible to the Purely Outdoors developer's processes and services.
Purely Outdoors developers do not store PII in removable media including, but not limited to USB, unsecured public cloud applications and/or public links made available through Google Drive.
Purely Outdoors developers securely dispose of any printed documents containing Personally Identifiable Information.
Logging & Monitoring
Purely Outdoors developers create logs to detect security-related events including, but not limited to access and authorization, intrusion attempts or configuration changes to their applications and systems.
Purely Outdoors developers have logging mechanisms on all channels including, but not limited to service APIs, storage-layer APIs or administrative dashboards providing access to Amazon Information. All logs have access controls to prevent any unauthorized access and tampering throughout their lifecycle. Logs themselves do not contain Personally Identifiable Information and are retained for at least 90 days for reference in the event of a Security Incident.
Purely Outdoors developers have active mechanisms to monitor the logs and all system activities to trigger investigative alarms on suspicious actions, including, but not limited to, multiple unauthorized calls, unexpected request rate and data retrieval volume, or access to canary data records.
Purely Outdoors developers perform an investigation when monitoring alarms are triggered. This event is documented in the Developer's Incident Response Plan.
Audit
Purely Outdoors developers maintain all appropriate books and records reasonably required to verify compliance with the Acceptable Use Policy, Data Protection Policy, and Amazon Marketplace Developer Agreement during the period of agreement and for 12 months thereafter.
Upon Amazon's written request, our developers will certify in writing to Amazon that they are in compliance with these policies.
Purely Outdoors developers will cooperate with Amazon or Amazon's auditor in connection with the audit, which may occur at the Purely Outdoors developer's facilities and/or subcontractor facilities. If the audit reveals deficiencies, breaches, and/or failures to comply with Amazon or Amazon's auditor's terms, conditions, or policies, Purely Outdoors, at its sole cost and expense, take all actions necessary to remediate those deficiencies within an agreed-upon timeframe.