Security

How Summado handles merchants' data, how the metrics are produced, what role AI plays and how you can report security issues.

Operator and access to data

Summado is operated by Daniel Wiegand under the name Wiegand-Digital. Wiegand-Digital is an entity separate from the merchants, with its own permissions. Each merchant authorizes Summado themselves and only for their own accounts.

Only the operator has access to the merchants' data. There are no employees and no contractors with access to this data. Should this change, Summado will disclose it on this page and in the privacy policy before any other person is given access.

No buyer data

Summado does not request any roles for restricted data (Restricted Roles) from Amazon and therefore has no access to names, addresses, email addresses or phone numbers of buyers. Summado does not store any information that could identify a buyer, neither in the database nor in logs or answers to your AI assistant.

Protecting the data

• Encryption: TLS for all connections over the internet; the credentials for your accounts are protected by envelope encryption with AES-256-GCM.
• Customer separation: Each customer's data is kept separate from that of other customers. A query only sees the data of the customer it is made for.
• Storage location: The database is located in a data center in the Frankfurt region (Germany). Some of the providers Summado uses for this are based outside the EU. The providers, their location and the basis for transfers are listed in the privacy policy.
• No analysis across merchants: Summado does not combine the data of different merchants, does not create benchmarks from other merchants' data and does not use the data for its own purposes.
• Further development: Summado continuously extends its security measures along with the service.

Retention and deletion

Summado keeps data only as long as it is needed for the purpose for which you shared it. The earliest applicable deadline always applies.

• Sales, order, inventory and financial data: as long as the booked history (Starter 12 months, Pro 24 months, with add-on 36 months). Summado deletes older data on an ongoing basis.
• Raw files (reports and responses from the interfaces): at most 30 days from retrieval. After that, the values exist only in the processed tables.
• Credentials: deleted immediately when you disconnect a connection, revoke the authorization or the access is no longer valid.
• Disconnecting a connection or cancellation: All data of the connection or of the customer is deleted, and no later than 30 days after that also in the backups.
• Request by Amazon: deletion to the extent requested within 30 days, including the backups.
• Audit log (record of queries, without business data): 12 months.
• Answers in the AI assistant: Summado does not store a copy of the answers. What your AI assistant retains depends on your contract with its provider.

Calculations, data freshness and AI

Here Summado discloses how the metrics are produced, how accurate and how current they are and what role AI plays.

Calculations

• Revenue, units, sessions: sums of the daily values from the channels' reports over the selected period, per ASIN or SKU. Comparisons with an earlier period show the change between the two sums.
• Margin per SKU: revenue minus fees and the purchase prices (COGS) that you upload. No margin can be calculated for a SKU without a purchase price.
• Days of supply: available inventory divided by the average units sold per day, in days.
• Advertising metrics: ACoS (advertising costs relative to advertising revenue), ROAS (advertising revenue relative to advertising costs), TACoS (Amazon advertising costs relative to Amazon revenue) and margin per SKU after advertising costs. Amazon Ads reports are in preparation and not yet available.
• Every answer states the marketplace, currency and time zone of the values.

Source and accuracy of the values

The values come from the reports and interfaces of the channels. The channels correct some values after the fact, for example the attribution of sales or fees. Summado therefore reloads the last 3 to 14 days in every daily run. Until then, and because of later corrections, values can change and differ from what Seller Central shows.

Data freshness

Every answer carries a timestamp (data_freshness) that shows when the data was last updated. Summado answers questions from its own database and does not query the channels live. How often the data is reloaded depends on the plan (Pricing):

• Starter: once a day.
• Pro and Agency: once a day, plus several times a day for orders and inventory.

Use of AI

• Summado does not call a language model itself. The metrics are produced by fixed calculation rules, not by AI.
• Summado does not train models with your data and does not pass it on for training.
• The answers are interpreted by the AI assistant that you connect to Summado yourself. Its statements can be inaccurate or wrong. Check important figures before you base decisions on them.
• Only use an AI assistant whose provider does not train on the answers, by contract or by a setting in your account. Summado cannot check this setting.

Reporting security issues

Please send reports of security vulnerabilities, data protection issues and suspected misuse of Amazon data to security@summado.de. The address is also listed in /.well-known/security.txt. Reports in German or English are welcome.

• Every report is recorded and followed up until it is closed.
• Please describe what you observed and how it can be reproduced. Do not include any business data or third-party data.
• Summado does not offer a bug bounty program and does not promise any rewards.