Security

Last updated: 20 October 2026

Connecting your Amazon business to an AI assistant should not mean handing over the keys. Here is how Sebastian keeps your accounts and data safe.

Connecting to Amazon

Amazon-hosted authorization. You approve access on Amazon's own Seller Central, Vendor Central or Amazon Ads pages. We never ask for, see or store your Amazon password.
Official APIs only. We read and change your account data only through Amazon's Selling Partner API and Amazon Ads API — no browser automation of your Seller Central, Vendor Central or Ads account.
Encrypted tokens. The tokens Amazon issues are encrypted at rest and used only by our backend services. They are never shown in the app or sent to AI providers.
Revoke any time. Remove the authorization in Amazon or delete the store in Sebastian and syncing stops immediately.

Your data

Account isolation. Every customer account is separated at the database layer. Queries that are not tied to an account are refused rather than run across accounts.
Encryption. All traffic uses TLS. Secrets such as Amazon tokens and two-factor keys are additionally encrypted in the database.
No model training. Our AI providers process your data through business APIs that do not use it to train their models.
Least-privilege access. Only a small number of our engineers can access production systems, and only when needed to operate or support the Service.

Your team

Roles and permissions. Decide who can view sales, run reports, manage stores, request listing changes or publish them to Amazon.
Store access. Limit each team member to the stores they work on.
Two-factor authentication. Protect every sign-in with an authenticator app.

AI clients and MCP connections

You can use Sebastian from AI clients such as Claude or ChatGPT through the Model Context Protocol. Those clients never receive your Amazon credentials.

Scoped API keys. Each key acts as you, with your permissions, and can be limited to specific stores.
OAuth connections. Connections approved through OAuth inherit the limits of the key they belong to.
Revoke instantly. Revoking a key stops its connections and any queued work it started; you can also end all OAuth connections at once.

Changes to your Amazon listings

Review before publishing. Listing changes suggested by Sebastian or imported from files become change requests. Nothing is sent to Amazon until someone with the publish permission approves it.
Separate permissions. Requesting a change and publishing it to Amazon are separate permissions, so you can require a second pair of eyes.
History. Each change request keeps its content, its review status and the outcome of the submission to Amazon.

Report a security issue

If you believe you have found a vulnerability, email support@webextreme.bg with the subject "Security". Please include the affected URL or feature, steps to reproduce and the impact you expect.

Do not send passwords, tokens or customer data exports by email.
Do not access, change or delete data that is not yours, and do not degrade the Service (no denial-of-service or automated mass testing).
Give us reasonable time to fix the issue before disclosing it publicly.

We acknowledge reports within 3 business days, keep you updated while we investigate and fix the issue, and notify affected customers and Amazon where required.