Overview

Amazon will enforce a revamped set of security and data‑protection rules for the Selling Partner API (SP‑API) on June 25 2025. The updates raise the bar on encryption, credential handling, supply‑chain oversight, and incident response. Sellers and developers who keep their integrations active after the deadline automatically accept the new terms, making early preparation essential.

Key Points

• Encryption baseline — All API traffic must use TLS 1.2 or higher; any integration still on TLS 1.0/1.1 will be blocked after the deadline.
• Credential rotation — API keys must be regenerated on a regular schedule, and password policies must remember the last ten passwords to prevent reuse.
• Supply‑chain scope — Third‑party vendors, contractors, and subcontractors are now subject to the same data‑protection standards as the primary API user.
• Vulnerability remediation — Critical flaws must be patched within seven days, while high‑risk issues have a 30‑day deadline.
• Data‑retention limits — Non‑PII records may be kept for a maximum of 18 months; security logs require at least 12 months of storage.
• Key Management System (KMS) — Organizations handling encrypted data must adopt a formal KMS for key generation, storage, rotation, and retirement.

What's Changing

1. Standardized terminology — Amazon now uses a unified “Selling Partner” lexicon and defines roles such as “Primary API User” and “Authorized Representative.”
   Example: A developer who previously referenced “seller account” must update documentation to the new “Selling Partner” term to avoid compliance warnings.

2. Network‑level hardening — Anti‑virus and malware solutions must incorporate tamper‑prevention controls, and accounts lock after ten consecutive failed logins.
   Example: A third‑party integration that only logs failed attempts will need to add an automatic lockout feature after the tenth failure.