Incident Response Policy

The Incident Response Policy establishes a structured, rapid-reaction protocol to identify, contain, investigate, and remediate potential information security events, including unauthorized access attempts, credential compromises, data anomalies, or network disruptions.

The overarching priority is to protect seller data, prevent unauthorized dissemination of customer information, minimize operational disruption, and maintain full compliance with Amazon notification timelines and European legal notification mandates (Article 33/34 GDPR).

Ledermode GbR maintains a designated Incident Response Lead and technical emergency structure with distinct duties:

• Incident Commander: Directs the overall containment strategy, authorizes system isolations, and coordinates external communications.
• Technical Forensics Lead: Analyzes server telemetry, inspects API logs, determines root cause, and implements patch containment.
• Data Privacy & Legal Liaison: Evaluates legal notification thresholds under GDPR and contractual requirements under Amazon's developer agreements.

Our incident management adheres to a structured six-phase operational lifecycle:

• Phase 1 — Preparation: Establishing security baselines, configuring telemetry alerts, training personnel, and maintaining verified response playbooks.
• Phase 2 — Detection & Analysis: Identifying anomalous activity via system logs, automated threshold alerts, or external security advisories; triaging severity and determining blast radius.
• Phase 3 — Containment: Rapidly isolating affected virtual nodes, revoking compromised API keys or refresh tokens, terminating suspicious network connections, and preserving forensic memory snapshots.
• Phase 4 — Eradication: Removing malware or unauthorized artifacts, patching the underlying vulnerability, and re-verifying system integrity.
• Phase 5 — Recovery: Restoring operational state from verified clean backup archives, re-authenticating API services with fresh credentials, and monitoring for abnormal behavior.
• Phase 6 — Post-Incident Review (Lessons Learned): Conducting a blameless post-mortem within 5 business days, documenting root cause, and updating defensive controls.

In the event of a verified security incident affecting marketplace data or personal information:

• Notification to Amazon: In accordance with Amazon Developer Policy, any suspected compromise of Amazon SP-API credentials or unauthorized access to Amazon data will be reported directly to Amazon (via security@amazon.com and Seller Central) within 24 hours of confirmation.
• Notification to Supervisory Authorities (Art. 33 GDPR): If a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the competent supervisory authority (Der Hessische Beauftragte für Datenschutz) will be notified without undue delay and, where feasible, not later than 72 hours after becoming aware.
• Notification to Affected Sellers/Users (Art. 34 GDPR): When high risk to individuals is present, clear and concise notifications detailing the breach and recommended mitigations will be communicated without undue delay.

If you suspect a vulnerability or observe anomalous behavior involving our endpoints, report it immediately to our 24/7 security inbox: