Overview

On July 3 2024 Amazon introduced new, mandatory procedures for reporting security breaches and notifying the company of major corporate changes. The revisions are embedded in the Data Protection Policy (DPP) and the Acceptable Use Policy (AUP), and they replace the informal email routes and verbal notices that sellers previously relied on. Sellers and developers who ignore the new channels risk slower incident handling, compliance gaps, and potential penalties.

Key Points

• Dedicated security mailbox — All security‑related reports tied to developer policies must now be sent exclusively to [email protected], eliminating the older ad‑hoc email addresses.
• Organizational change notice — Any modification to a seller’s legal structure—such as a merger, acquisition, or executive turnover—must be filed through the “Change Notification Form” in Seller Central within five business days.
• Policy cross‑reference — The DPP now explicitly links incident reporting to the AUP, so a violation of acceptable‑use rules automatically triggers the security‑reporting workflow.
• Escalation timeline — Amazon will send an automated acknowledgment within two hours of receiving a security email and will launch a formal investigation for high‑severity events within 24 hours.
• Record‑keeping requirement — Sellers must keep copies of every incident report and change‑notification submission for at least 12 months to satisfy audit obligations.
• Case‑ID assignment — Each submission receives a unique case identifier that must be referenced in all subsequent communications, ensuring traceability across the investigation lifecycle.

How the New Reporting Process Works

1. Identify the event — Determine whether the situation is a security incident (e.g., exposed credentials, data leakage) or an organizational change (e.g., formation of a new legal entity). Example: A developer discovers that an API key was accidentally pushed to a public GitHub repository.
2. Gather required details — Compile timestamps, affected assets, impact assessments, and any immediate remediation steps for security events; for structural changes, collect legal documents, new tax identification numbers, and updated contact information. : The exposed API key report lists the repository URL, date of exposure, and the steps taken to rotate the key and revoke the compromised token.