This public policy explains how OTOECOM manages security incidents, protects credentials, restricts marketplace access, and secures network and data handling for Amazon, Flipkart, Meesho and other ecommerce platforms.
This policy applies whenever OTOECOM handles seller data, customer PII, marketplace access, API tokens, reports, catalog files, order information, support screenshots or operational data for an approved seller service.
Amazon data is handled under Amazon's data protection, acceptable use, role access and security-control expectations.
Seller panel access, order data, payment reports, catalog details and shipment records are handled only for approved seller work.
Store, logistics, ad, analytics and support tool access is controlled using least-privilege and purpose-limited processing.
Internal notes, screenshots, case records, performance reports and training data are protected by access controls and retention rules.
OTOECOM treats these controls as one connected security process. Incidents are handled quickly, credentials are protected from exposure, and network/data systems are restricted, monitored and reviewed.
Security events are identified, classified, escalated, contained and reviewed through a documented response process.
Credentials, API keys, tokens and user access are protected through least-privilege and controlled authorization.
Marketplace data is protected using secure transfer, access control, encryption, malware protection and monitoring.
A security incident may include unauthorized access, suspected credential exposure, malware detection, abnormal API activity, accidental data disclosure, loss of marketplace data, or any event that may affect confidentiality, integrity or availability of seller or customer information.
Incident procedures are reviewed at least every six months and after major process, platform or infrastructure changes.
Each incident is assigned to an accountable owner with internal escalation and seller communication responsibility.
Where Amazon data is affected, OTOECOM notifies Amazon within 24 hours of detection where required and follows the relevant marketplace notification process.
Maintain contact lists, escalation rules, access inventories, backup procedures, security awareness, credential controls and incident checklists for seller portal and marketplace data events.
Review alerts, unusual login behavior, abnormal API usage, suspicious exports, malware warnings, seller reports or employee observations to determine severity, affected systems and affected marketplaces.
Limit impact by revoking exposed credentials, disabling access, blocking suspicious sessions, isolating affected files, pausing unsafe exports, rotating keys and removing malicious or unauthorized activity.
Restore approved service access only after validation, confirm that affected credentials or files are secured, document remediation, and verify that business operations can resume safely.
Document the incident timeline, root cause, affected data, decisions, notifications, corrective actions and lessons learned. For Amazon data incidents, Amazon is notified within 24 hours of detection where required.
OTOECOM does not request master passwords, OTPs or personal login sessions unless a seller voluntarily provides temporary supervised access for a permitted support purpose. Wherever possible, official sub-user access, role permissions or authorized integrations are used.
Sensitive credentials are not stored in website code, source files, public repositories, documents, screenshots or shared notes.
Credentials and seller access details are stored only in approved, access-controlled systems and shared only with authorized personnel who need them for the service.
Access is reviewed periodically and removed when employees leave, service ends, the seller requests revocation, or the permission is no longer required.
Team members receive only the access needed for assigned tasks such as catalog work, ads, reporting, order support, training or account health support.
Amazon, Flipkart, Meesho and other platforms may provide different access models. OTOECOM follows the stricter platform rule where a marketplace requirement is stricter.
Passwords are required to be strong, unique and protected. Suspicious login patterns, repeated failed attempts or unauthorized sharing are escalated for review.
If any credential, token, seller portal access, API key or authorization appears exposed, OTOECOM treats it as a security incident, revokes or rotates the credential where possible, reviews affected activity, documents the event and informs the seller or marketplace when required.
Administrative systems and marketplace workstations are protected with firewall controls, approved access rules and restrictions that reduce unauthorized network traffic.
Access is separated by role, department, service need and platform. Seller data is kept inside approved tools and is not copied into uncontrolled personal storage.
Multi-factor authentication is used wherever supported. Suspicious login attempts, unusual access times or repeated failures are reviewed and escalated.
Sensitive files, exports, reports and credentials are transmitted through secure channels. PII and credentials are encrypted or stored in protected systems where applicable.
Company devices used for marketplace services are expected to run updated anti-malware protection, security updates and scans to reduce infection risk.
Access logs, support records, incident notes and marketplace activity evidence are reviewed when needed for security investigation, misuse detection and incident response.
OTOECOM follows the relevant marketplace rule and applies the stricter control where a marketplace, law, seller agreement or security requirement demands a higher standard.
Amazon data, SP-API credentials, Seller Central permissions and customer PII are handled according to Amazon data protection and security expectations.
Flipkart seller panel access, catalog data, order data, shipment details, returns, payment reports and advertising reports are used only for approved seller services.
Meesho seller information, listing data, logistics information, orders, returns, payments and customer delivery details are processed only for the seller's requested service.
For Shopify, WooCommerce, logistics tools, ad accounts, analytics tools, D2C stores and other ecommerce platforms, OTOECOM applies purpose limitation, least privilege and secure handling.
Contact OTOECOM with your seller account name, marketplace, incident description, affected data if known, time of detection and authorized contact details. OTOECOM will verify, investigate and respond according to this policy.