Security Overview: Ledermode GbR employs defense-in-depth: mandatory MFA, network firewalls, isolated credential stores, continuous dependency auditing, and tamper-resistant security logging with zero-plaintext storage of access tokens.
1. Information Security Mandate
Ledermode GbR maintains an Information Security Policy designed to protect confidential business data, API tokens, and connected marketplace endpoints against unauthorized access, modification, disclosure, or destruction.
This policy applies across our entire operational perimeter: cloud infrastructure, application codebases, administrative workstations, and developer environments.
2. Network Boundaries & Firewall Controls
Our production environment is ring-fenced by multi-layered perimeter defenses:
- Stateful Firewalls & Security Groups: Only inbound ports strictly necessary for web traffic (HTTPS port 443) are publicly reachable. Direct database ports and SSH administrative ports are blocked from the public Internet.
- Network Segmentation: Application servers, operational queues, and internal databases reside within isolated virtual network segments with strictly filtered internal traffic.
- DDoS & Rate Limiting: Web entry points employ automated rate-limiting and filtering to thwart distributed denial-of-service attempts and abusive automated scrapers.
3. Access Controls, Passwords & MFA
Access to production systems is rigorously controlled:
- Mandatory Multi-Factor Authentication (MFA): MFA is strictly enforced across all administrator accounts, developer consoles, and cloud hosting management portals.
- Strong Password Policy: Passwords must meet modern length and complexity standards, and are verified against known compromised credential datasets.
- Least Privilege & Role Separation: Staff are granted only the minimum operational capabilities necessary for their active roles. Access privileges are reviewed quarterly.
- Session Timeouts: Administrative sessions automatically terminate after inactivity to prevent unauthorized physical terminal access.
4. Credential & Secret Management
The safeguarding of Amazon SP-API developer credentials and cryptographic tokens is paramount:
- Zero Hardcoded Secrets: API keys, client secrets, and database passwords are never committed to version control repositories.
- Environment-Based Secret Injection: Credentials are injected at runtime via encrypted environment variable stores with strict access audit trails.
- Scheduled & Event-Driven Rotation: Operational tokens are rotated systematically. Any credential suspected of compromise is revoked and regenerated immediately.
5. Vulnerability Management & Patching
We maintain a continuous vulnerability monitoring and software maintenance routine:
- Automated Dependency Auditing: Application dependencies and libraries are scanned continuously for Common Vulnerabilities and Exposures (CVEs) during deployment checks.
- Timely Patch Deployment: Security patches for host operating systems, Node.js runtimes, and core packages are applied within defined service-level timeframes.
- Controlled Code Reviews: Code changes affecting API interactions or data handling require structured review prior to production merging.
6. Security Logging & Monitoring
Our infrastructure maintains centralized logging to ensure operational visibility:
- Audit Trail Generation: Authentication attempts, privilege escalations, API status changes, and critical administrative actions are recorded with high-resolution timestamps.
- Log Tamper Resistance: Audit logs are stored in append-only storage volumes inaccessible to standard unprivileged user accounts.
- No Sensitive Data in Logs: Customer PII, raw passwords, and full API authorization bearer tokens are explicitly sanitized and excluded from server logs.