quinceMCP

Security

Last updated October 29, 2026

How we protect your Amazon accounts and the data that comes from them, and how to report a problem.

Connecting to Amazon

  • You authorize Quince MCP on Amazon's own consent pages. We never ask for or store your Amazon password, and we never use your Seller Central login.
  • We only use Amazon's official Selling Partner API and Amazon Ads API. No scraping, no screenshots and no browser automation.
  • We request only the access the features need, and none of the roles that include buyer personal information.

Encryption

  • All traffic uses HTTPS with TLS 1.2 or higher.
  • Amazon refresh and access tokens are encrypted with AES-256 before storage. The key is kept outside the database and rotated at least every 12 months.
  • The database is encrypted at rest by our hosting provider.
  • Tokens are used only by our servers. They never appear in tool results, in your AI app or in our logs.

Access

  • Each customer's Amazon data is tagged with the account it came from, and every request is limited to the accounts the signed-in customer connected.
  • Only the people who run the Service can reach production systems. Their accounts use multi-factor authentication and strong passwords, lock after repeated failed logins, and are reviewed every quarter.
  • We look at a customer's Amazon data only to provide the Service, to fix a problem they reported or when the law requires it.

Changes to your account

  • Every type of change is off until you switch it on.
  • The AI app can only propose. Bids, budgets, prices and new campaigns are approved on a page on quincemcp.com that the AI app's login can't reach.
  • Each proposal stores the values it was based on and is refused if your account changed in the meantime.
  • A retried request can't apply the same change twice.
  • Hard limits apply to bids and budgets, and large moves need a second confirm.
  • Text inside your data, such as a search term or a product title, can't trigger a change.
  • Every change is logged with the before and after values and who approved it, and can be undone.

Monitoring and incidents

  • We log access and changes and keep security logs for 12 months.
  • We keep an incident response plan and review it every six months.
  • If an incident involves Amazon data, we notify Amazon at security@amazon.com within 24 hours of detecting it, and we notify affected customers without undue delay.

Deletion

When you disconnect or close your account, we revoke your Amazon tokens straight away and permanently delete your Amazon data within 30 days. See the Data Protection page.

Report a security issue

Email support@quincemcp.com with "Security" in the subject. We'll confirm we got it and keep you updated until it's fixed. Please don't test against other customers' accounts.