TRUST CENTER

Your Amazon Ads API connection, secured by design

Connecting ad software to your Amazon account takes trust. We hold no ISO or SOC 2 certifications — and we won’t pretend otherwise. What we can show you is the actual engineering: how the connection works, the single permission we ask for, what we store (and what we don’t), how your tokens are stored, and how you take it all back in one click. Last updated: September 29, 2026.

How connecting works

Login with Amazon — the standard OAuth 2.0 flow

BidPilot uses the same “Login with Amazon” mechanism Amazon offers every developer. At no point do we see or store your Amazon password.

  • You click “Connect” in your BidPilot dashboard. BidPilot creates a single-use, unpredictable connection link tied to your account.
  • You sign in and approve on Amazon’s own site. The login page is Amazon’s — your password goes to Amazon, never to us.
  • Amazon sends a one-time authorization code back to BidPilot’s server. The code is useless on its own and can only be redeemed once.
  • Our server exchanges the code for tokens directly with Amazon. The exchange happens server-to-server — your access tokens are never handled in your browser.
  • Tokens are encrypted and stored; you get a confirmation email. From then on, BidPilot uses the stored tokens to read your ad data and manage campaigns within the single permission you granted.

Minimal scope

One permission. Nothing else.

When you approve the connection, BidPilot requests exactly one Amazon Ads API scope:

cpc_advertising:campaign_management

That’s ad campaign management — reading and managing your advertising campaigns. We don’t request access to your Seller Central orders, payouts, or personal Amazon account, and the token we hold can’t be used for any of that.

In practice, BidPilot uses this access to read your campaigns, ad groups, keywords and performance reports — that’s what powers your dashboard, health score and audits. The scope you grant is stored alongside your tokens, so you can verify at any time exactly what was approved and nothing more.

What we store

Your connection record — and nothing more

Connecting BidPilot creates exactly one connection record in our database. Here is everything in it:

  • Your access and refresh tokens — encrypted. The two tokens Amazon issues for your account. They’re encrypted before they’re stored (see the next section) and are never written to logs.
  • When the access token expires, the scope granted, and the region. Just enough metadata to keep the connection working and to prove exactly what you approved.
  • Your ad data is fetched on demand, not warehoused. Campaign and report data is pulled from Amazon when you open your dashboard or run an audit. We don’t keep a standing copy of your ad account in our database.
  • What’s never stored. Your Amazon password — we never see it, so we can’t store it. Your Seller Central orders, inventory and payouts — the scope can’t grant them, so there’s nothing to store. Single-use connection links are kept only as one-way SHA-256 hashes, and the hash is deleted the moment the link is used (or ten minutes later if it isn’t).

Token storage

Encrypted at rest — or not stored at all

  • Authenticated encryption. Access and refresh tokens are encrypted with libsodium’s secretbox (authenticated encryption) before they touch the database, each with its own random nonce.
  • Per-install key. Encryption uses a 32-byte key generated for this BidPilot installation at setup — tokens encrypted here can’t be decrypted anywhere else. (Installations that predate the generated key fall back to a key derived from the installation’s database credentials, so older tokens keep working.)
  • Short-lived access, automatic refresh. Access tokens expire quickly by design. BidPilot’s server refreshes them in the background using the encrypted refresh token, and the new tokens are encrypted again before they’re stored. If you revoke access at Amazon, the refresh is rejected and you’re simply asked to reconnect — there is no lingering access.
  • Tokens never travel through your browser. The authorization-code exchange and every token refresh happen server-to-server between BidPilot and Amazon. Your browser is only ever sent to Amazon’s own sign-in page and back.
  • Fail-safe, never fail-open. If the server can’t encrypt, the connection is refused with an error instead of storing your tokens in plain text.
  • Admin secrets get the same treatment. The Amazon login client secret and payment gateway API keys are stored encrypted too — never in plain text.

Anti-abuse

Connection links that can’t be reused

  • Single-use. Each connection link is deleted the moment it’s used — a copied or replayed link fails verification.
  • 10-minute expiry. Links that aren’t used expire ten minutes after they’re created.
  • Hash-stored. Only a one-way hash of each link is kept; the raw link value is never stored.

Disconnect & revoke

Take it all back, any time

Two independent ways to cut the connection — either one works on its own.

Fastest

Disconnect in the dashboard

One click deletes your stored Amazon tokens immediately. We log the event and send you a confirmation email, so there’s a record it happened.

Independent

Revoke at Amazon

Remove BidPilot’s access from your Amazon account settings at any time. The stored tokens stop working instantly — the next sync simply fails closed.

Disconnecting deletes your Amazon tokens immediately — your BidPilot account, settings and trial stay intact, so reconnecting later takes one click. If you’d rather leave nothing behind at all, email support@bidpilot.online and we’ll delete your account record and campaign data too.

Data handling

Plain-language data promises

  • We don’t sell or share your advertising data. Your campaign data is used to run BidPilot for you — nothing else.
  • No borrowed credibility. We hold no ISO 27001, SOC 2, or similar certifications, and we won’t imply otherwise. This page describes the actual engineering instead.
  • Free tools keep data in your browser. The 38 free tools compute entirely on your device — nothing you paste is uploaded or stored.
  • Deletion on request, handled by us. There is no self-service account deletion: email support@bidpilot.online and we’ll delete your account record and campaign data. Billing records and audit logs are retained for accounting and operations; Amazon connection tokens are deleted on request — or instantly when you disconnect in the dashboard.

FAQ

Security questions, answered honestly

No. You sign in on Amazon’s own site during the Login with Amazon flow. Amazon sends BidPilot a one-time authorization code, and our server exchanges it for tokens directly with Amazon. Your password never touches BidPilot.
Only what the single scope we request allows: your Amazon Ads campaigns, ad groups, keywords and reports ( cpc_advertising:campaign_management ). We don’t request — and the token can’t grant — access to your Seller Central orders, payouts, or personal Amazon account.
In BidPilot’s database, encrypted with libsodium authenticated encryption (secretbox), each with its own random nonce, keyed by a 32-byte key generated for this installation at setup. If the server can’t encrypt, the connection fails safely instead of storing tokens in plain text.
One connection record: your encrypted access and refresh tokens, when the access token expires, the scope you granted, and the region. That’s the whole record. Your password is never seen or stored, and ad data is fetched on demand when you open your dashboard or run an audit — we don’t warehouse a copy of your ad account.
No. The authorization-code exchange, and every later token refresh, happens server-to-server between BidPilot and Amazon. Your browser only ever visits Amazon’s own sign-in page and comes back with a one-time code.
Your stored Amazon tokens are deleted immediately and the event is logged and emailed to you. Your BidPilot account and settings stay, so reconnecting is one click. For full deletion of your account record and campaign data, email support@bidpilot.online — billing records and audit logs are retained for accounting and operations.
Two ways, and either works alone. In your BidPilot dashboard, one click on Disconnect deletes your stored tokens immediately and sends you a confirmation email. Or revoke BidPilot’s access from your Amazon account settings at any time — the stored tokens stop working instantly.
No. We don’t sell or share your advertising data. It’s used to run BidPilot for you — nothing else. Admin credentials (the Amazon login client secret, payment gateway keys) are stored encrypted as well.
No — and we won’t imply otherwise. We hold no third-party security certifications. This page shows what we actually do instead: minimal scope, encrypted token storage, single-use connection links, and one-click disconnect.
There is no self-service account deletion: email support@bidpilot.online with your account email and we’ll delete your account record and campaign data. Billing records and audit logs are retained for accounting and operations; Amazon connection tokens are deleted on request — or immediately when you disconnect in the dashboard.

Judge the product, not the promises.

Run a free PPC account audit — no signup — or start your 30-day free trial. No setup fees, no contracts, no cancellation fees.

Start free trial Get my free audit

38 free tools · No signup · 30-day free trial