Cloud environment report: available on request
The AWS environment behind the application: identity, data storage, environment separation and the configuration controls the DPP names directly.
This is one of three reports from a single engagement (2026-09-ACM), written to the format we submit for Amazon Selling Partner API Data Protection Policy reviews. It carries 12 findings, each with a CVSS score, reproduction steps, evidence and a remediation deadline derived from DPP clause 2.7.3.
What this report evidences
- ›Identity and access management, least privilege and credential handling
- ›Data storage configuration and encryption at rest against the DPP minimum
- ›Environment separation and change management
- ›Logging and monitoring coverage as audit evidence
Scope category under the Data Protection Policy: 2.7.2 cloud environments. The DPP requires a penetration test at least every 365 days using an industry recognised methodology; it does not require the tester to hold any particular empanelment or certification.
Ask and a founder will send it
We send the full set: web and API, external network, and cloud, as three PDFs. Requests are read by Ashok or Rathnakara before anything is sent, which is why this is not an instant download. Tell us what you are building against SP-API and which restricted role you hold, and the reply will be useful rather than automated.
Request the SP-API report setWant to see how we write a report before asking? The full generic sample report is published in its entirety, no request needed, and uses the same structure, severity model and evidence standard.