Data Security and Amazon
Information Protection

1.Official Seller Authorization

Sellers authorize Tess Core LLC through Amazon’s official Solution Provider authorization process. Access is used only for services included in the client’s agreed scope. Sellers retain ownership and final control and may revoke authorization through Amazon. We do not request a seller’s primary Seller Central password.

2.Authorized Team

Four Tess Core LLC employees may access Amazon information when required for assigned services:

3.Role-Based Access

• Each employee uses an individual Amazon-authorized identity.
• Access is assigned by responsibility and limited to the minimum permissions needed.
• Access is reviewed when responsibilities change, when a client engagement ends, or when employment ends.
• Seller Central access is not shared between employees.

4.Authentication and Credentials

• Multi-factor authentication is enabled for Amazon access and supported business accounts.
• An encrypted password manager is used for authorized business credentials.
• Strong, unique passwords are required.
• Passwords and MFA codes may not be shared.
• Credentials are not stored in unprotected documents, spreadsheets, emails, or chat messages.

5.Device and Network Protection

• BitLocker or equivalent full-disk encryption on all four authorized computers.
• Individual password-protected user accounts and automatic screen locking.
• Current operating-system and security updates.
• Antivirus or endpoint security protection.
• Access restricted from unauthorized individuals.
• No intentional storage on public computers or unauthorized removable storage.
• Secure network use for accessing Amazon information.

6.Downloaded Information

Seller Central reports and operational files are downloaded only when necessary. Files are stored on encrypted computers used by authorized employees and are not transferred to personal accounts, unauthorized devices, public file-sharing locations, or unrelated third parties.

7.Information Sharing

Tess Core LLC does not sell Amazon information, use it for unrelated commercial purposes, share one seller’s information with another seller, or disclose it to contractors, freelancers, or unrelated companies, except when legally required.

8.Retention and Secure Deletion

When a client engagement ends, applicable Seller Central access is revoked and downloaded Amazon information is securely deleted from authorized employee computers within 30 days, unless a longer period is legally required or necessary for an active client-authorized matter. Deletion is documented in an internal record.

9.Access Changes and Offboarding

When an employee’s role changes or employment ends, Tess Core LLC removes applicable Seller Central, password-manager, device, and business-system access and requires removal of locally stored client information according to the retention policy.

10.Security Reviews

Tess Core LLC periodically reviews authorized users, permission levels, device-security settings, stored information, and the continued business need for access. Suspected unauthorized access, device loss, malware, credential exposure, or accidental disclosure must be escalated immediately.

11.Incident Response

Our incident-response process covers unauthorized access, credential compromise, device loss, malware, file exposure, and accidental disclosure.

• Identify and document the suspected incident.
• Contain affected accounts, devices, and access.
• Revoke or change compromised credentials.
• Investigate the information and clients affected.
• Preserve records necessary for investigation.
• Notify affected clients, Amazon, or authorities when required.
• Correct the underlying issue and document preventive actions.

12.Client Responsibilities

• Protect their primary account credentials and MFA methods.
• Review permissions granted to providers.
• Promptly revoke unnecessary access.
• Notify Tess Core LLC of suspected unauthorized activity.