How we protect seller and customer information.

We maintain a written Incident Response Plan covering preparation, identification, containment, eradication, recovery and lessons learned, with specific procedures for credential compromise, unauthorised account access, malware and data loss.

• Amazon is notified at security@amazon.com within 24 hours of our detecting any security incident that involves Amazon or seller information. Affected sellers are notified in parallel.
• A designated Incident Management Point of Contact (IMPOC) owns the response; current IMPOC details are kept with the plan and shared with Amazon on request.
• The plan is approved by company management, reviewed every six months, and updated after major infrastructure changes or incident lessons learned.
• Internal escalation paths, roles and decision-making authority are documented; an annual risk assessment is reviewed by management.
• Procedures cover notifications to government agencies where required by law and status communication to affected clients.
• All monitoring-alarm investigations and incidents are logged and retained with the incident record.

Report a suspected security issue: info@calium.in (subject line: "Security incident") or +91 78273 04742.

Our services are delivered inside the seller's own Seller Central and Amazon Ads accounts. We do not copy customer PII (buyer names, addresses, phone numbers, e-mail addresses) out of Amazon systems unless a specific, documented task requires it (for example, resolving a shipment or return case).

• Any PII that must be handled is retained for no longer than 30 days after order delivery, and is then securely deleted unless a specific legal, tax or regulatory obligation requires longer retention, in which case it is archived in encrypted storage only.
• Non-PII data (sales, advertising, catalog and performance reports) is retained only as long as strictly necessary for the engaged service, with the business purpose documented, and deleted at the end of the engagement.
• Within 30 days of a seller revoking our access, ending the engagement, or Amazon requesting deletion, all seller information held by us — including backups — is permanently deleted. Retention beyond this is permitted only to meet legal, tax or regulatory obligations.
• PII and non-PII data are classified and tagged separately; the classification schema is documented and applied consistently across all storage systems.
• Deletion follows industry-standard sanitisation methods (NIST SP 800-88).
• PII is never stored on removable media, personal devices or unsecured public cloud links. Printed material containing PII is destroyed by approved methods.

Systems and devices used to access seller information are protected by layered network and endpoint controls and are restricted to Approved Users with a documented business need.

• Network firewalls and access-control lists deny traffic by default; our office network is segmented so that devices used for client work are isolated from guest and general-purpose segments.
• Intrusion detection / prevention capability and application-layer protection (WAF or equivalent) are applied to any internet-facing system we operate; this website runs behind an edge WAF/CDN with TLS 1.2+ enforced.
• All devices that access seller information run managed anti-malware / endpoint-protection software with real-time scanning, automatic definition updates (at least monthly) and scheduled full scans; end users cannot disable protection.
• Endpoints use full-disk encryption, removable-media restrictions, controlled administrative rights and automatic screen lock after no more than 15 minutes of inactivity. Access from personal or unmanaged devices is not permitted.
• Approved Users are employees and contractors with a documented business need who have completed data-protection and IT-security awareness training; training is repeated at least annually.
• Network architecture documentation and evidence of firewall, endpoint-protection and monitoring controls are maintained and available to Amazon on request.

We never request or store a seller's primary Amazon login. Access is granted by the seller as a secondary user in Seller Central or Amazon Ads, scoped to the roles the engaged service requires, and revocable by the seller at any time.

• Each team member has a unique, named account; shared, generic or default credentials are prohibited.
• Multi-factor authentication is required on all Calium accounts used to access Amazon or seller systems, and we require sellers to keep Amazon's two-step verification enabled.
• Passwords are at least 12 characters with mixed case, numbers and symbols, must not contain any part of the user's name, cannot reuse the last 10 passwords, and expire within 365 days.
• Accounts lock after no more than 10 failed sign-in attempts; failed-login and anomalous-access events are monitored.
• Any API keys, tokens or stored credentials are encrypted at rest (AES-256), held in a secure secrets store, never shared in plain text, and rotated at least annually or immediately on suspected compromise.
• Access is granted on least-privilege, reviewed quarterly, and removed within 24 hours when a team member leaves or changes role. Sellers are asked to remove our secondary-user access at the end of every engagement.
• Information in transit is encrypted with TLS 1.2 or higher; file exchange with clients uses encrypted channels only.

Where we operate systems that handle seller information, access is logged centrally and reviewed, and systems are kept patched on defined timelines.

• Security logs capture timestamps, user identity, success/failure, access attempts, data changes and system errors; they are protected from tampering, exclude PII, and are retained for at least 12 months.
• Logs are reviewed at least bi-weekly (or in real time where automated tooling is in place) for suspicious activity, unexpected request rates and access-pattern anomalies.
• Vulnerability scans run at least every 30 days; critical-risk findings are remediated within 7 days and high-risk findings within 30 days.
• Penetration testing and a third-party security assessment are performed annually; backup and recovery procedures are tested quarterly.
• An inventory of all devices, systems and applications that handle seller information is maintained and reviewed quarterly; changes follow a formal change-control process.

Client services are delivered by Calium's in-house team. The only third parties involved are practising chartered accountants engaged for statutory tax filings under the Taxes service.

• No seller or customer information is shared with any third party without the seller's written consent and a documented business need.
• Any vendor or subcontractor with potential access to seller information is risk-assessed before access is granted and at least annually thereafter, and is bound by confidentiality and data-protection terms equivalent to ours.