Trust Center
What we actually do with your data, and how we can prove it
This page replaces a previous Trust Center that listed certifications and claims AMZ Prep couldn't back up. Everything below comes from AMZ Prep's actual Data Processing Agreement, confirmed certifications, and current review platform scores. Where we don't have a real figure to publish, we say so instead of making one up.
Company & Legal
Who you're actually contracting with
AMZ Prep operates as its own registered entity, with facilities in three countries and its headquarters in Canada.
- Legal entity: AMZ Prep Inc.
- Registered address (US): 238 Bay Ridge Parkway, Brooklyn, NY 11209
- Headquarters (Canada): 9 Van der Graaf Crt, Brampton, ON L6T 5E5, Canada
- UK facility & UK GDPR representative: AMZ Prep, Unit 3, Mountpark, 5 Wide Ln, Southampton SO18 2FA, United Kingdom
- Governing law: Ontario, Canada. Disputes go to mediation in Ontario first, then binding arbitration under Ontario's Arbitration Act if mediation doesn't resolve it. Ontario courts hold exclusive jurisdiction.
- Trust, security & privacy contact: info@amzprep.com. One inbox handles security questions, privacy requests, and DPA inquiries, so there's nowhere the request can land in the wrong department.
- Phone: +1 (437) 783-5798
Compliance Frameworks
GDPR, UK GDPR, CCPA, and PIPEDA
AMZ Prep handles personal data from sellers and their end customers across North America and Europe, so compliance isn't optional in any of the jurisdictions it operates in.
Full compliance across both regimes. A designated privacy team oversees GDPR compliance day to day. This isn't a formal Data Protection Officer role, since AMZ Prep's processing activity doesn't legally require one, but the function exists and is staffed. The UK representative address is listed in Company & Legal above, and ICO registration is completed.
Compliant with the California Consumer Privacy Act for California residents whose data passes through AMZ Prep's systems.
Compliant with Canada's Personal Information Protection and Electronic Documents Act, which governs how AMZ Prep collects, uses, and discloses personal information in the course of commercial activity.
Submitting a data subject request
Email info@amzprep.com with the subject line "GDPR Request - [Your Name]". Include your full name, contact details, the specific rights you're exercising (access, correction, deletion, and so on), and any relevant details about where your data is located. AMZ Prep responds within one month.
Certifications & Recognition
What AMZ Prep is certified for, and what isn't published here
These are the certifications and platform recognitions AMZ Prep currently holds. ISO 27001 and SOC 2 Type II are both completed; we haven't published certificate numbers or completion dates for either because we don't have those specifics verified for public posting. Enterprise customers can request the underlying documentation directly.
Security Measures
Technical, physical, and organizational controls
These are the actual controls documented in AMZ Prep's Data Processing Agreement, grouped by category.
| Category | Controls in place |
|---|---|
| Technical | Encryption of data in transit and at rest, multi-factor authentication, role-based access control, regular vulnerability assessments, firewalls and intrusion detection systems |
| Physical | 24/7 monitored access control at all facilities, CCTV surveillance, visitor management protocols, biometric and keycard entry, restricted secure zones for high-value inventory, fire suppression and climate monitoring |
| Organizational | Employee background checks, employee data protection training, confidentiality agreements with staff whose obligations survive termination, documented incident response procedures, business continuity and disaster recovery planning |
Data Lifecycle
How long we keep data, and what happens when you leave
Retention periods vary by data type, driven mostly by tax and accounting requirements rather than an arbitrary policy.
| Data type | Retention period |
|---|---|
| Customer account data | Duration of business relationship plus 7 years |
| Transaction records | 7 years, for tax and accounting purposes |
| Marketing communications | Until consent is withdrawn |
When a client leaves
AMZ Prep returns personal data in a standard format and deletes it from all systems within 90 days of termination, then provides written certification confirming the deletion took place. Data that's required by law to be retained longer stays under the same protections as active data, and nothing beyond what's legally required is kept.
International Transfers
Moving data across borders
With facilities and customers spanning Canada, the US, the UK, and Europe, cross-border data transfer is a routine part of operating AMZ Prep, handled through the standard legal mechanisms rather than ad hoc agreements.
- EU Standard Contractual Clauses (SCCs) govern transfers out of the European Economic Area.
- UK International Data Transfer Agreement (IDTA) covers transfers out of the United Kingdom.
- Adequacy decisions apply where a destination country has one in place.
Audit Rights
What enterprise customers can verify directly
Enterprise customers aren't limited to taking AMZ Prep's word for its controls. The Data Processing Agreement gives them a defined path to check.
Enterprise customers may request compliance documentation covering AMZ Prep's security and data protection practices.
Up to once per year, with 30 days' advance written notice. An independent third-party auditor can be engaged under confidentiality.
Customers may receive a recent third-party audit report in place of an on-site inspection.
Sub-processors
Who else touches your data
AMZ Prep uses third-party vendors for infrastructure, payments, shipping, and business operations. The core categories are below; a complete, current sub-processor list is maintained and available to customers on request.
| Category | Vendors |
|---|---|
| Infrastructure & cloud | AWS, Google Cloud Platform, Microsoft Azure, Cloudflare, Cherry Servers |
| Business operations | HubSpot, Salesforce, DocuSign, Adobe Sign, Slack, Microsoft 365, Asana, Linear, Monday.com |
| Content & productivity | QuillBot |
| Payment & financial | Stripe, PayPal, Square, Authorize.net |
| Shipping & logistics | FedEx, UPS, DHL, USPS, ShipStation |
| Analytics & marketing | Google Analytics, Segment, Mixpanel, Meta, LinkedIn, Marketo |
| Customer support | Zendesk, Intercom, Freshdesk, Typeform, Front |
| Security & monitoring | Datadog, Sentry, Auth0, Okta, New Relic, PagerDuty, 1Password |
Breach Notification
If something goes wrong
AMZ Prep notifies affected customers without undue delay upon becoming aware of a data breach. In practice, that typically means within 72 hours, though the legal commitment in the DPA is "without undue delay" rather than a fixed window. From there, AMZ Prep investigates the incident, implements remedial measures, provides the information needed for any regulatory notifications the customer has to make, and documents the breach along with the actions taken in response.
Independent Reviews
Current scores across review platforms
Pulled directly from each platform. The old version of this page claimed a perfect 5.0 on G2, which was wrong; the real number is below.
Primary Sources
Read the actual legal documents
Rather than take our summary of these policies at face value, read the source documents directly.
FAQ
Common questions about security and compliance
What compliance frameworks does AMZ Prep follow?
AMZ Prep is compliant with GDPR, UK GDPR, CCPA, and PIPEDA. A designated privacy team oversees GDPR compliance, and AMZ Prep's UK representative is based at the Southampton facility listed in the Company & Legal section above. ICO registration is completed.
How do I submit a data subject request?
Email info@amzprep.com with the subject line "GDPR Request - [Your Name]". Include your full name, contact details, the specific rights you're exercising, and any relevant details about where your data is located. AMZ Prep responds within one month.
What happens if AMZ Prep experiences a data breach?
AMZ Prep notifies affected customers without undue delay upon becoming aware of a breach. In practice that typically means within 72 hours, though the legal commitment is 'without undue delay' rather than a fixed window. AMZ Prep then investigates the incident, implements remedial measures, provides the information needed for any regulatory notifications, and documents the breach and the actions taken.
Can enterprise customers audit AMZ Prep?
Yes. Enterprise customers may request compliance documentation and conduct audits up to once per year with 30 days' advance written notice. They may engage an independent third-party auditor under confidentiality, or receive a recent third-party audit report instead of an on-site inspection. The customer covers audit costs unless the audit finds material non-compliance, in which case AMZ Prep covers the cost.
How long does AMZ Prep retain customer data?
Customer account data is retained for the duration of the business relationship plus 7 years. Transaction records are kept for 7 years for tax and accounting purposes. Marketing communications data is retained until consent is withdrawn.
What happens to our data when we stop working with AMZ Prep?
AMZ Prep returns personal data in a standard format and deletes it from all systems within 90 days of termination, then provides written certification that the deletion happened. AMZ Prep retains only what's required by law, under the same protections as active data.
Is AMZ Prep GDPR, CCPA, and PIPEDA compliant?
Yes, on all three. AMZ Prep is fully compliant with GDPR and UK GDPR, compliant with CCPA for California residents, and compliant with PIPEDA for Canadian personal information.
What security certifications does AMZ Prep hold?
AMZ Prep is ISO 9001:2015 certified, ISO 27001 certified, and operates an FDA-registered facility. SOC 2 Type II is completed. Specific certificate documentation for ISO 27001 and the SOC 2 Type II report are available to enterprise customers on request.
How does AMZ Prep transfer data internationally?
International transfers run under EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), and adequacy decisions where applicable.
Who do I contact for a security or privacy question?
Email info@amzprep.com for any trust, security, privacy, or data processing agreement question. That's the single contact point AMZ Prep uses for these inquiries, so there's one inbox to reach rather than several department addresses.
Does AMZ Prep publish an uptime guarantee?
No. AMZ Prep doesn't publish an invented uptime percentage. Every warehouse runs on live order and inventory data, and if a system issue affects your operations, your account manager is the first point of contact, not a ticket queue.
Does AMZ Prep publish a full list of sub-processors?
The core categories, infrastructure, business operations, payments, shipping, analytics, support, and security tooling, are listed in the Sub-processors section above. A complete, current sub-processor list is maintained and available to customers on request.
Need documentation for a security review?
Certificate copies, the SOC 2 Type II report, or the full sub-processor list can be sent directly to your security or procurement team.
