Security & Disclosure

• Secure connection. You connect through Amazon’s own sign-in (OAuth). We never see or store your Amazon password.
• Encrypted credentials. The access token that lets us manage your ads is encrypted at rest and isolated to your account.
• Never in logs. Access credentials are never written to application logs, error reports, or analytics.
• Least privilege. Internal access to systems and data is limited to what each function requires, and reviewed.
• Tenant isolation. Each publisher’s data is isolated; your data is never used to benefit another customer.
• Amazon Data Protection Policy. All Amazon-derived data is handled in line with Amazon’s Data Protection Policy.

If you believe you’ve found a security vulnerability in Book Midas, please tell us. We welcome responsible disclosure and will not pursue or support legal action against researchers who act in good faith.

• Acknowledge — we confirm receipt of your report within 2 business days.
• Assess — we investigate, determine severity, and keep you updated on progress.
• Remediate — we fix confirmed issues as a priority, fastest for the most serious.
• Close the loop — we let you know when it’s resolved, and credit you if you’d like.

If a security incident affects your data, we will investigate promptly, contain it, and notify affected customers and relevant authorities as required by law and by Amazon’s policies, with a plain account of what happened and what we did about it.

Security reports: security@bookmidas.com. Privacy questions: see our Privacy Policy.