网站安全Website safeguards
官网使用 HTTPS 和有效证书，HTTP 自动跳转 HTTPS；启用内容安全策略、禁止页面被第三方框架嵌入、限制浏览器摄像头及位置权限。证书自动续期已通过演练。网站没有密码输入框、付款入口或店铺令牌接收入口。The website uses HTTPS with a valid certificate and redirects HTTP to HTTPS. Content security and framing policies are enabled; camera and location permissions are restricted. Automated certificate renewal has been tested. There are no password, payment or store-token collection interfaces.
最小数据范围Minimum data scope
首期接入设计仅服务于授权卖家的经营和广告效果分析。不申请买家姓名、电话、配送地址，不提供发货或买家联系功能；不修改广告预算或竞价。报告生成请求可以创建报告任务，但不改变卖家的经营设置。Initial integrations are designed solely for authorized seller business and ad-performance analysis. Buyer names, phones and delivery addresses are excluded, as are shipping and buyer-contact functions. No budget or bid changes are made. Report requests may create reporting jobs but do not change seller business settings.
独立授权Separate authorizations
SP-API 与 Ads API 分别申请访问，每个卖家或广告账户独立授权。我们不会要求通过邮件提供后台密码或令牌。当前官网尚无 OAuth 回调或生产同步，只有完成平台许可和验证后才开放真实连接。SP-API and Ads API access are requested separately, with independent authorization for each seller or advertising account. We never ask for account passwords or tokens by email. The current website has no OAuth callback or production synchronization; connections open only after platform permission and validation.
日志与运维Logs & operations
当前站点通过 SSH 管理，站点日志采用管理员及服务账户访问权限，并按日轮转、保留最多 14 份历史文件。服务器不存储通过 Amazon API 获取的卖家数据。数据保存与隐私请求详见隐私政策。The site is administered over SSH. Site logs are restricted to administrators and service accounts, with daily rotation and up to 14 historical files. No seller data obtained through Amazon APIs is stored on this server. Retention and privacy requests are described in the privacy policy.
安全问题与删除请求Security & deletion requests
发现疑似漏洞或异常访问，请向 it-service@qiyunto.com 提供发生时间、受影响页面和不含敏感信息的复现步骤。请勿访问其他人的数据或扩大测试范围。隐私请求 5 个工作日内确认，核实后的删除请求通常在 30 天内完成。Report suspected vulnerabilities or unauthorized access to it-service@qiyunto.com, including time, affected page and non-sensitive reproduction steps. Do not access others’ data or expand testing. Privacy requests are acknowledged within five business days; verified deletion requests are normally completed within 30 days.