Online Enablers is an Amazon Service Provider Network (SPN) partner. Handling your seller account comes with real responsibility — here's specifically what we do to protect it.
Every staff account is individual — we don't use shared or generic admin logins. Admin accounts support two-factor authentication (TOTP, via any standard authenticator app), and repeated failed login attempts trigger an automatic account lockout.
Your Amazon refresh token is encrypted at rest before it's ever stored — it's never written to our database in plain text. All traffic to and from our platform is encrypted in transit (HTTPS/TLS). Passwords are hashed with bcrypt, never stored in reversible form.
Every client's data — orders, reports, connections — is scoped to that client's account. One client's bearer token cannot read or modify another client's data. This isn't just a design intent: it's covered by an automated test suite that specifically tries to breach it and confirms it can't.
Logins, logouts, MFA events, and access to your connected Amazon seller data are recorded in an internal audit log, reviewable by our team. We only access your Amazon data to provide the services you've engaged us for — never to build a separate product or benefit another client.
Connecting your Amazon account happens exclusively through Amazon's own Selling Partner API (SP-API) OAuth flow — you authorize access directly on Amazon's site. We don't ask you to paste in credentials or tokens manually.
If your account is deactivated, your access is revoked immediately and your data is retained for 90 days (in case reactivation is needed) before it becomes eligible for deletion. You can request account deletion at any time from your client portal settings.
If you believe you've found a vulnerability in our platform, we want to know. Please report it responsibly and we'll respond promptly.
Report a Security Issue