Security and data protection at Terra PPC
Terra PPC is designed around authorized access, account scoping, data minimization, secure transport, operational traceability and documented data lifecycle controls.
Terra PPC is a software product operated by Terra Flora Global LLC. Terra Flora Global LLC is the legal operator responsible for the Terra PPC website and service.
Security principles
Six principles shape how Terra PPC handles access and data. Statements on this page describe design principles and intended controls unless they refer to this public website.
- Authorized access
- Account connections are designed around Amazon-provided authorization mechanisms, never shared passwords.
- Least privilege
- People and services receive only the access their legitimate function requires.
- Account scope
- Operations stay tied to the relevant organization, account, profile and marketplace.
- Data minimization
- Only data needed for enabled functionality is accessed and retained.
- Operational traceability
- Important automation and operational actions are designed to be recorded for review.
- Data lifecycle
- Retention is limited, and a documented process handles account-data deletion requests.
Credential and token protection
Authorization tokens and application credentials are treated as secrets. Terra PPC's production architecture is designed so that they are:
- kept on the server side only — never in the browser or in website code;
- never displayed on the website, placed in URLs or written to general-purpose logs;
- available only to the services that need them to call Amazon APIs;
- replaceable, so a credential can be rotated or revoked if exposure is suspected.
About this website: the public Terra PPC website contains no Amazon client credentials, refresh tokens or other secrets, and it does not display tokens or account identifiers.
Data in transit
Production web services are designed to use HTTPS/TLS for network transport. This website is intended to be served over HTTPS only and instructs browsers to keep using HTTPS for the domain. Connections to Amazon APIs use Amazon's HTTPS endpoints.
Data at rest
Terra PPC's production architecture is designed to store customer data with encryption at rest and with access restricted to the services that need it. This page does not name specific algorithms, key-management products or hosting regions.
Tenant and account isolation
Terra PPC is designed to keep customer operations logically scoped to the relevant organization, authorized account, profile and marketplace. Every rule, recommendation, action and AI-assisted request is designed to carry its scope and to be validated against it before it runs.
ORGAccountProfileMarketplaceOrganization, then account, then profile, then marketplace.
Least privilege
Access only where it is needed. Terra PPC is designed so that:
- People
- Team members receive only the access their role requires. Access to customer data is limited to legitimate support, operational and security needs.
- Services
- System components receive only the permissions their function requires, including access to Amazon-related data.
- Customer users
- Users inside a customer organization can be given role-appropriate permissions, and sensitive operations require appropriate authorization.
Amazon data handling
Terra PPC uses authorized data only for approved functionality and applicable account context, subject to Amazon permissions and requirements.
- Minimum necessary data. Only what enabled functionality needs.
- Authorized functionality only. Used to provide the features the customer enabled.
- Need-to-know access. Limited to people and services with a legitimate reason.
- No public publication. Amazon-related data is not published or made publicly available.
- No data selling. It is not sold, resold or offered as a standalone dataset.
AI/MCP security
AI and MCP are interaction layers, not data access. Terra PPC AI/MCP is designed so that an AI client receives scoped context for the selected organization, account, profile and marketplace — never unrestricted raw database access. A policy layer decides which tools and action types are available, and any change still passes the configured mode and guardrails.
Automation safety
Automation runs in one of three modes — Manual, Review or Auto — and no mode bypasses authorization, scope, guardrails, permissions or audit logging. Guardrails such as bid floors and ceilings, change caps, cooldowns and action limits apply to every automated or recommended change, and conflicting rules are designed to resolve deterministically, with the outcome recorded.
Logging
Terra PPC is designed to record:
- Operational events
- Account connections and disconnections, data synchronization and processing outcomes.
- Security-relevant events
- Sign-ins, permission and authorization changes, and access to sensitive functions.
- Automation actions
- Evaluations, recommendations, approvals, rejections, applied changes and blocked actions.
Logs are designed to exclude secrets such as tokens and passwords, and to be kept only as long as needed for security, operations and applicable obligations.
Data retention and deletion
Customer data is retained only as long as needed for enabled functionality, the customer relationship and applicable legal obligations. When an account is disconnected or a deletion request is approved, eligible data is designed to be deleted or de-identified according to applicable requirements.
Incident reporting
If you believe you have found a vulnerability, suspect misuse of Amazon-related data, or see exposed credentials, report it through the security reporting page. Reports are reviewed and investigated, and confirmed incidents involving Amazon-related data are handled in line with applicable Amazon requirements, including notification obligations.
Security controls evolve
Security controls may evolve as Terra PPC's production infrastructure, product functionality and applicable requirements change.
This page describes design principles and intended controls. It does not claim third-party security certification.
Terra PPC is a software product operated by Terra Flora Global LLC.