Amazon's Data Protection Policy (DPP) for Selling Partner API solution providers says, in section 2.7.2, that a "Solution Provider must perform penetration testing at least every 365 days using an industry-recognized methodology." The policy page carries no date, but Amazon's changelog of 12 August 2026 says the updated DPP applies "Starting August 25, 2026," in all Amazon stores, with "expanded vulnerability scanning and penetration testing requirements, including for APIs." The preamble is blunt about the stakes: failure to comply "may result in suspension or termination of Amazon Services API access."
The clause lands on SaaS vendors that hold Amazon buyer data through the API, such as shipping, tax and order management connectors. The Canadian English DPP carries the same section 2.7 text.
Quick answer. Yes, for any SP-API solution provider whose systems hold Amazon PII. DPP section 2.7.2 requires a penetration test "at least every 365 days using an industry-recognized methodology," covering network infrastructure, cloud environments, web applications, APIs, databases and storage, plus desktop or mobile apps where they exist, and section 2.7.3 gives 7 days to fix critical and 30 days to fix high findings. Amazon names no approved tester, accreditation or report format and has no step that accepts the report: its guidance allows "qualified security professionals or third-party firms," and the report is evidence you keep for Amazon's security review and a Section 3 audit. Stingrai, a CREST-accredited penetration testing firm in Toronto, runs that test across network, cloud, application-layer and mobile scope, as a one-time annual engagement or a continuous program.
What DPP section 2.7 says
Section 2.7, Vulnerability Management, opens with a duty to keep "a documented vulnerability management plan and/or runbook" and to find and fix vulnerabilities across every system, application and infrastructure component that stores, processes or transmits Amazon data. Four numbered clauses follow:
Clause | What it requires (condensed from the DPP) | Clock |
|---|---|---|
2.7.1 | Vulnerability scanning | At least every 30 days |
2.7.1 | Change-triggered scanning after significant network, application or infrastructure changes | After each significant change |
2.7.1 | Code scanning for vulnerabilities | Before each software release |
2.7.2 | Penetration testing with an industry-recognized methodology, covering the systems that process, store or transmit Amazon data | At least every 365 days |
2.7.3 | Remediation of findings from scanning, penetration testing and code scanning | Critical: 7 days from discovery; high: 30 days |
2.7.4 | Disaster recovery, with a geographically separated backup site | Maintained |
Section 2.7.2 lists four scope categories: network infrastructure (public-facing and internal boundaries, firewalls, routers and switches); cloud environments (platforms, services and configurations); application-layer assets (web applications, APIs, databases and file or object storage); and other in-scope systems "as applicable," such as desktop or mobile apps. The test must assess "external-facing components, application functionality, access controls, system configurations, and interfaces."
Four details matter for the statement of work:
No method is named. Amazon's Vulnerability Management guide points to OWASP material; NIST SP 800-115 and the OWASP Web Security Testing Guide are common choices. Name yours in the report.
The clock is in days, a rolling 365 from the last test, not a calendar year.
Remediation runs from discovery. A critical finding found on day 3 of a test is due on day 10, report or no report.
Only critical and high have deadlines, and the DPP defines neither, so agree the rating scale up front.
Who the clause covers, and who it does not
The penetration testing clause sits in Section 2, on personally identifiable information. It applies "If an Amazon Services API contains PII, or PII is combined with non-PII," and then "the entire data store must comply." Section 1, which binds every Solution Provider, has no penetration testing clause, though it still requires a web application firewall or equivalent on internet-facing endpoints, multi-factor authentication and account lockout. Amazon's Key Security Control Guidance agrees: the remediation clocks apply to "solution providers that store or process PII."
Who: "Solution Providers" means developers, public or private, and service providers.
What PII means: the DPP's definition is broad, including a buyer's name, address, email, phone number, gift message, IP address and geo-location.
Which roles: Amazon's roles page, updated 13 October 2026, marks five roles Restricted, meaning they require "sensitive information, which might include" PII: Direct-to-Consumer Shipping, Tax Invoicing, Tax Remittance, Professional Services and Selling Partner Support. In the Orders API, a buyer's email needs Direct-to-Consumer Shipping.
Who is outside 2.7: an app that never receives PII. It still owes Section 1, and it falls under Section 2 the day PII lands in one of its data stores.
What changed in November 2025 and August 2026
Figure 1: DPP section 2.7 in three versions, read from Internet Archive captures of 5 November 2025, 23 November 2025 and 4 August 2026 and from the live policy on 23 October 2026. Sources: Amazon, Data Protection Policy and Amazon SP-API changelog.
The test interval has been 365 days throughout. What moved is everything around it:
Scanning: the policy captured on 5 November 2025 said "at least every 180 days"; the 23 November 2025 capture says 30 days, although Amazon's November 2025 notice did not list the change. A template that still says 180 days predates November 2025.
Fix deadlines: the November 2025 revision, effective 25 November, added 7 days for critical and 30 days for high findings and raised log retention from 90 days to 12 months.
Scope: the August 2026 revision added change-triggered scans, the methodology wording, the four scope categories and the five areas to assess, none of which appear in the 4 August 2026 capture. Continued use of the API after 25 August 2026, Amazon says, "means you accept the updated agreement and policies."
Who can perform the penetration test the DPP requires
The DPP sets no tester qualification. None of the Amazon pages read for this brief (the DPP, the Acceptable Use Policy, the Solution Provider Portal Agreement and Amazon's SP-API guides on security, roles and registration) names an approved vendor, a required accreditation such as CREST, or a report format.
Amazon's Key Security Control Guidance fills part of the gap: "Perform annual penetration testing using qualified security professionals or third-party firms." A qualified in-house team is therefore acceptable on Amazon's own reading. Two caveats sit in the same guide: its cadence table lists "Conduct formal third-party security assessments" as a separate annual task, and its notice says the guide "does not create any commitments," so the DPP text governs.
An outside firm earns its fee at audit time. Under Section 3, Amazon or "an independent certified public accounting firm selected by Amazon" may audit, and in our view a report from an outside firm with named testers, dates and a stated method is easier to defend there than an internal one. CREST accreditation is not an Amazon requirement; it is a yardstick buyers use, and the CREST Marketplace lists accredited firms.
Two practical points apply whoever tests. DPP 2.8 requires an annual risk assessment of any vendor or subcontractor "before granting them access to Amazon data," so assess the testing firm and keep buyer PII out of its hands where the scope allows. And Amazon's guide says to "Review AWS Penetration Testing guidance before testing AWS services": AWS allows tests of its permitted services without prior approval, and our cloud rules of engagement guide covers the other clouds.
What Amazon reviews, and when
At registration. For Restricted roles, Amazon's onboarding guide describes three stages: a business review; a security review in which Amazon "verifies your compliance documentation"; and a technical review in which "You meet with an Amazon solution architect." The public developer guide adds an architecture review with the SP-API Solutions Architecture team, covering "data flows and protection controls for PII," which "can involve a demo through screen sharing," and a data security assessment phase. Your Security Controls answers "should accurately reflect" how you implement the DPP, and Amazon closes a case if you do not answer its questions within five days.
While you hold the role. Amazon's Security and Compliance Overview says apps "must also pass mandatory data security assessments." DPP Section 3 adds the audit: you keep books and records for the agreement term and 12 months after, certify compliance in writing when Amazon asks, let Amazon or a CPA firm it selects audit your systems, fix deficiencies at your own cost, and supply remediation evidence (policy, documents, screenshots or screen sharing) until Amazon approves it in writing. Section 4.2 of the Solution Provider Portal Agreement lets Amazon suspend or terminate immediately if you fail "data handling or data processing requirements."
How long until a penetration test report is accepted
Amazon publishes no acceptance step and no review time for a penetration test report. The report is evidence you hold for the security review, the data security assessments and any Section 3 audit. These are the clocks Amazon does publish:
Clock | Length | Source |
|---|---|---|
Answer Amazon's review questions | 5 days, or the case closes | Public developer guide |
Standard (non-restricted) role review | Typically one to two weeks | Onboarding guide |
Restricted role review | No duration published | Onboarding and public developer guides |
Fix a critical finding | 7 days from discovery | DPP 2.7.3 |
Fix a high finding | 30 days from discovery | DPP 2.7.3 |
Retest | "After the remediation stage" | Vulnerability Management guide |
Next penetration test | Within 365 days of the last | DPP 2.7.2 |
Close an audit | On Amazon's written approval of remediation evidence | DPP Section 3 |
In practice, the report becomes useful evidence once its findings are fixed and retested: Amazon's guide says providers "must run a second pen test to validate that all identified vulnerabilities have been completely remediated," and the 2.7.3 clocks put every critical and high fix inside 30 days of discovery.
Scoping the test for an SP-API integration
DPP 2.7.2 category | What it means for an SP-API integration | Engagement line |
|---|---|---|
Network infrastructure | Internet-facing hosts, VPNs, firewalls and the internal boundaries around systems that hold order data | |
Cloud environments | The AWS, Azure or Google Cloud accounts: identity and access, storage policies, key management, logging | |
Application-layer assets | The seller-facing web app, its APIs and webhooks, the authorization flow, and the databases and object storage holding PII | Web application and API test, authenticated across every role |
Other in-scope systems | Mobile apps used by sellers or warehouse staff |
Our recommended objectives for an integrator, each tied to a DPP control:
Seller isolation: one seller's account must never reach another seller's orders (1.3 and 1.8); see our multi-tenant scope guide.
Token storage: refresh tokens and API keys encrypted at rest (1.4.2); see our OAuth and connected app scope guide.
Firewall coverage: every internet-facing endpoint behind the web application firewall "regardless of protocol" (1.1.1).
Stray PII: buyer data in logs (2.6.1) or kept past 30 days after delivery (2.1).
DPP 2.5 requires separate test and production environments, while 2.7.2 covers the systems that hold Amazon data, so the rules of engagement should name the production components in scope.
Why scanners and SP-API Guard do not replace the test
The DPP lists scanning (2.7.1) and penetration testing (2.7.2) as separate duties, and Amazon's guide says the test is there "to confirm which vulnerabilities can be exploited by bad actors." SP-API Guard, Amazon's serverless tool, scans AWS data against the DPP and returns a findings report after 24 hours, using Amazon Macie, GuardDuty, Inspector, IAM Access Analyzer, Security Hub and Config. It checks AWS configuration; it does not test application logic, seller isolation or other clouds. Amazon's voluntary Security Compliance Self-Check "does not replace Amazon's formal security assessment requirements" (Policies and Agreements). Run Guard before the test to clear configuration gaps.
The evidence pack
Figure 2: An SP-API DPP evidence pack, mapped to the clauses and guides it answers, read 23 October 2026. Sources: Amazon, Data Protection Policy and Amazon, Vulnerability Management.
Amazon's guide adds one requirement for the report itself: "The pen tester must include a recommended actions section in the report." Keep the pack current through the agreement and for 12 months after. The DPP names neither SOC 2 nor ISO 27001; our guide to pentest evidence auditors accept covers reusing one report for those programs.
A first-year plan
When | What | Basis |
|---|---|---|
Month 0 | List the roles and data stores that hold PII; update network and data flow diagrams | Section 2; 1.1.3 |
Month 0 onward | Scans every 30 days and after significant changes; code scans before each release | 2.7.1 |
Months 1 to 2 | Penetration test across the four categories; fix criticals within 7 days and highs within 30 | 2.7.2; 2.7.3 |
Month 3 | Retest; assemble the evidence pack | Vulnerability Management guide |
Each review or audit | Answer Amazon's questions within five days; provide remediation evidence | Onboarding guides; Section 3 |
Within 365 days of the last test | Next test, rescoped for new systems and APIs | 2.7.2 |
The months are our plan; only the intervals come from the DPP.
What it costs
Amazon sets no budget; the scope does. Stingrai's fixed prices cover one web application and associated APIs: the Autonomous Pentest by Snipe, with no penetration testers, is US$3,000 per assessment or US$650 a month on a 12-month plan and delivers the pentest report; the Hybrid Pentest is US$6,800 per assessment or US$1,275 a month and adds an attestation letter (pricing). At the Bank of Canada USD to CAD rate of 1.4021 on 22 October 2026, those are about C$4,206, C$911, C$9,534 and C$1,788. Those packages cover the web application and API part of 2.7.2's application-layer category only. A full DPP scope with network, cloud, database and storage, and mobile testing is human-led and quoted through Get a Quote; the pentest cost calculator gives a first estimate.
Questions to ask a penetration test provider for a seller application
Will the report name the method and test dates, show scope against all four 2.7.2 categories and include a recommended actions section?
Is the retest included, and will findings reach us as they are confirmed, so the 7- and 30-day clocks can be met?
Who are the named testers, and which certifications does the team hold?
Will you test seller isolation, token storage and every internet-facing endpoint behind the firewall?
How will you handle Amazon data you see, and will you complete our vendor risk assessment under 2.8?
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For an SP-API solution provider, Stingrai runs the annual test across network infrastructure, cloud environments, the application layer and, where they exist, mobile apps, and hands over the evidence a security review or Section 3 audit can ask for. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, and Stingrai Inc. holds CREST accreditation for penetration testing (CREST Marketplace).
Application layer: authenticated web application and API testing across every seller and administrator role, aimed at broken authorization, IDOR and business logic.
Cloud and network: AWS, Azure and Google Cloud from the control plane to the workload, plus external and internal network testing of the boundaries around Amazon data.
Mobile: iOS and Android testing aligned with OWASP MASVS where sellers or staff use an app.
Evidence: every confirmed finding, at every severity, is posted to the PTaaS platform as it is confirmed, with a proof of concept and remediation guidance, so the 7- and 30-day clocks start with a fix plan. Retesting is included, and every human-led and hybrid report ships with an attestation letter.
Engagements run as a one-time annual test timed to your 365-day clock or as a continuous program. Snipe, Stingrai's autonomous AI agent, covers web applications and their APIs only, so it fits the web application and API part of the scope; network, cloud, database and storage, and mobile work is human-led. Stingrai's testing supports your DPP compliance program and produces evidence you keep for Amazon's review and audit. Stingrai is based in Toronto with a London office and serves US and Canadian clients remotely.
Frequently Asked Questions
Does the Amazon SP-API Data Protection Policy require a penetration test?
Yes, for solution providers whose systems hold Amazon PII. DPP section 2.7.2 requires penetration testing at least every 365 days using an industry-recognized methodology, covering network infrastructure, cloud environments, application-layer assets and other in-scope systems such as mobile apps. Section 1, which binds every solution provider, has no penetration testing clause.
Who can perform the penetration test the Amazon SP-API Data Protection Policy requires?
The DPP names no approved vendor, accreditation or report format. Amazon's Key Security Control Guidance says to perform annual penetration testing using qualified security professionals or third-party firms, so a qualified in-house team or an outside firm may test. The same guide lists formal third-party security assessments as a separate annual task.
How long does it take to get a penetration test report accepted for Amazon SP-API Data Protection Policy approval?
Amazon publishes no step that accepts or pre-approves a penetration test report, and no review time for Restricted roles. The report is evidence for the security review and any Section 3 audit, which closes only on Amazon's written approval of remediation evidence. The clocks Amazon does set are 7 days for critical and 30 days for high findings, a retest after remediation, and five days to answer review questions.
How do I choose an Amazon SP-API DPP penetration test provider for a seller application?
Ask for a report that names the methodology and test dates, shows scope against the four DPP 2.7.2 categories and includes a recommended actions section, with the retest included. Check that findings arrive as they are confirmed, that the testers are named, and that the firm will complete your annual vendor risk assessment under DPP 2.8.
Does the penetration test requirement apply if my app has no Restricted roles?
Not while the app never receives PII. Section 2, which holds the penetration testing clause, applies when an Amazon Services API contains PII, and then to the entire data store. Section 1 still applies to every solution provider, including a web application firewall on internet-facing endpoints, multi-factor authentication and account lockout.
Does SP-API Guard count as a penetration test?
No. SP-API Guard scans AWS configurations against the DPP and returns a findings report after 24 hours. It does not test application logic, seller isolation or systems outside AWS, and the DPP lists scanning and penetration testing as separate duties.
What changed in the August 2026 DPP update?
From 25 August 2026, section 2.7 adds change-triggered scans, requires an industry-recognized methodology, lists four scope categories for the penetration test and states that the 7- and 30-day fix deadlines cover findings from scans, tests and code scans. The 30-day scan cadence and the deadlines themselves arrived with the November 2025 revision.
Related reading
Cloud Penetration Testing Rules of Engagement: What AWS, Azure, and GCP Allow in 2026
How to Scope a SaaS OAuth and Connected App Penetration Test
Multi-Tenant SaaS Penetration Test Scope: A Buyer Guide (2026)
Third-Party API Integration Penetration Testing: Buyer Scope (2026)
Best Retail and E-commerce Penetration Testing Companies (2026)
References
Amazon. Data Protection Policy, Solution Provider version, en_US and en_CA. Read 23 October 2026. https://sellercentral.amazon.com/mws/static/policy?documentType=DPP&locale=en_US and https://sellercentral.amazon.com/mws/static/policy?documentType=DPP&locale=en_CA
Internet Archive. Captures of the Amazon Data Protection Policy, 5 November 2025, 23 November 2025 and 4 August 2026. https://web.archive.org/web/20251105012724/https://sellercentral.amazon.com/mws/static/policy?documentType=DPP&locale=en_US, https://web.archive.org/web/20251123044458/https://sellercentral.amazon.com/mws/static/policy?documentType=DPP&locale=en_US and https://web.archive.org/web/20260804203452/https://sellercentral.amazon.com/solution-provider/policy?policyType=DPP&locale=en_US
Amazon SP-API changelog. Updates to the Data Protection Policy and Acceptable Use Policy, 10 November 2025. https://developer-docs.amazon/sp-api/changelog/updates-to-the-data-protection-policy-and-acceptable-use-policy
Amazon SP-API changelog. Solution Provider Portal Agreement and Policy Updates, 12 August 2026. https://developer-docs.amazon/sp-api/changelog/sp-api-updates-solution-provider-portal-agreement-and-policy-updates-br-store-shippertrackingnumber-validation-and-listings-attribute-and-enumeration-values-changes
Amazon. Key Security Control Guidance, updated 9 September 2026. https://developer-docs.amazon/sp-api/docs/guidance-to-address-key-security-controls-in-sp-api-integration
Amazon. Vulnerability Management, updated 9 September 2026. https://developer-docs.amazon/sp-api/docs/vulnerability-management
Amazon. Step 3: Create a Developer Profile and Register as a Public SP-API Developer, updated 9 September 2026. https://developer-docs.amazon/sp-api/docs/onboarding-step-3-create-a-developer-profile and https://developer-docs.amazon/sp-api/docs/register-as-a-public-developer
Amazon. Selling Partner API Roles (updated 13 October 2026) and Access Orders PII. https://developer-docs.amazon/sp-api/docs/roles-in-the-selling-partner-api and https://developer-docs.amazon/sp-api/docs/access-orders-pii
Amazon. SP-API Security and Compliance Overview and Policies and Agreements. https://developer-docs.amazon/sp-api/docs/security-compliance-overview and https://developer-docs.amazon/sp-api/docs/policies-and-agreements
Amazon. Amazon Selling Partner API Guard Implementation Guide and Architecture Overview. https://developer-docs.amazon/sp-api/docs/sp-api-guard-implementation-guide and https://developer-docs.amazon/sp-api/docs/sp-api-guard-architecture-overview
Amazon. Solution Provider Portal Agreement. Read 23 October 2026. https://sellercentral.amazon.com/mws/static/agreement?locale=en_US
Amazon Web Services. AWS Customer Support Policy for Penetration Testing. https://aws.amazon.com/security/penetration-testing/
NIST. SP 800-115, Technical Guide to Information Security Testing and Assessment; OWASP. Web Security Testing Guide. https://csrc.nist.gov/pubs/sp/800/115/final and https://owasp.org/www-project-web-security-testing-guide/
Bank of Canada. Daily exchange rates, USD to CAD, 22 October 2026. https://www.bankofcanada.ca/rates/exchange/daily-exchange-rates/
Stingrai. Pricing and Snipe. https://www.stingrai.io/pricing and https://www.stingrai.io/snipe
Talk to Stingrai
Stingrai will scope your SP-API integration against the four DPP 2.7.2 categories and test it with named penetration testers from a CREST-accredited firm, with retesting and an attestation letter, as a one-time annual test or a continuous program. Get a quote or book a free discovery call.
