Back to All This week's SP-API updates include updates to the Data Protection Policy, Solution Provider Portal Agreement, and Acceptable Use Policy, ShipperTrackingNumber field validation enforcement for the Brazil Amazon store, and August updates to Listing attribute usage and enumeration values.

• Solution Provider Portal Agreement and Policy Updates
• ShipperTrackingNumber Field Validation Enforcement for Brazil Amazon Store
• August updates to Listing attribute usage and enumeration values

Solution Provider Portal Agreement and Policy Updates

Starting August 25, 2026, the Data Protection Policy, Solution Provider Portal Agreement, and Acceptable Use Policy will be updated for all Solution Providers. Most changes formalize existing security expectations, but some may require updates to your current security controls.

What's changing?

The Data Protection Policy now requires a web application firewall for internet-facing endpoints, storage encryption on all devices, a 15-minute screen lock, and a 30-minute lockout after ten failed login attempts. You must also designate an incident management point of contact, encrypt all credentials at rest, delete information within 30 days when required, and meet expanded vulnerability scanning and penetration testing requirements, including for APIs. The Solution Provider Portal Agreement clarifies that actions performed on behalf of customers are accurate, complete, and policy-compliant. We've also clarified when you must maintain insurance coverage and revised the Solution Provider Portal Agreement's reference to the Agent Policy to remove redundancies. The Acceptable Use Policy now includes a quality and performance standard for submissions made on behalf of authorized users and expands the throttling-circumvention prohibition.

Which Amazon stores are affected?

This change applies to all Amazon stores.

Who is affected?

Developers with applications that access the Solution Provider Portal are affected by this change.

What action is required?

If you have an application that is affected by this change, be sure to:

• Review the updated Data Protection Policy, Solution Provider Portal Agreement, and Acceptable Use Policy before August 25, 2026 to understand how these updates apply to your business.