Boring, deliberate, audit-ready.

Amazon’s Business Solutions Agreement (effective March 4, 2026) introduced Section 19, which formalizes obligations on software agents — automated tools, AI assistants, and API connectors — acting on a seller’s behalf. SelfPub Go is an agent under that definition.

Per ADR-0008, the compliance layer is not a feature we are planning to add. It is a foundation we built before exposing the platform:

• Stable identification. Every Amazon Ads API call carries a versioned User-Agent taggedagent=true, the tenant UUID, and the calling tool. Centralized in one HTTP client wrapper used by all outbound calls.
• Three-scope kill-switch. Global, per-tenant, and per-rule kill-switches stop all automated actions on request from Amazon, you, or our operators. State is DB-backed, not cached beyond 60 seconds.
• 12-month audit log.Every AI-inspired action — bid changes, negative keyword additions, budget changes — is logged with actor, parameters, and approval state. We retain 12 months minimum per Amazon’s requirement.
• Human approval on bid mutations. AI never pushes bid changes silently. Suggestions surface with rationale; you approve in bulk or one-by-one.
• Data isolation.Section 4.2 prohibits using Amazon data to train third-party AI/ML models. Your ads and royalty data is never used to train any model — ours or anyone else’s.

EU AI Act Article 50 (effective August 2, 2026) requires machine-readable labeling on AI-generated advertising creative for EU audiences. SelfPub Go’s AI Tools module emits the required disclosure metadata at generation time, and our integration with KDP’s upload API includes the March-2026 generative-AI Content Type field automatically when you publish AI-assisted descriptions.

For EU tenants, all AI inference runs through Anthropic’s EU endpoints by default — no data leaves the region for prompts or completions.

ADR-0009 made global multi-market a day-one architectural commitment. Practical consequences:

• Storage region per tenant. Every workspace carries a data_region flag (us, eu, ap). The Supabase database, file storage, and LLM endpoint routing follow that flag. Set at signup; changeable on Studio tier with a 7-day migration window.
• Currency and locale. Royalties stored in marketplace-native currency with conversion metadata; ad spend stored in Amazon Ads currency. We never store converted-only values.
• EU customers get default-EU residency, EU LLM endpoints, EU CDN, and EU error-monitoring tooling. GDPR Article 28 processor agreements are linked from the workspace settings.

The platform is multi-tenant on a single Postgres cluster. Isolation is enforced at three layers, top to bottom:

• Application. Every read and write goes through a tenant-scoped client. Cross-tenant joins are impossible at the query layer.
• Row-Level Security (RLS). Every Supabase table carries an RLS policy keying on tenant_id = auth.tenant(). Service role bypass is restricted to specific server-side mutations and logged.
• Storage. Files in Supabase Storage and Cloudflare R2 use signed URLs with tenant-scoped paths; expired URLs are non-recoverable.

We run automated cross-tenant probes nightly: a synthetic workspace tries to read its neighbor’s data. A failure of the probe alerts on-call before any human is impacted.

• In transit. TLS 1.3 everywhere. HSTS with preload on production domains. Strict CSP, no inline scripts in production.
• At rest. Supabase Postgres encrypts volumes with AES-256-GCM. Refresh tokens for Amazon Ads are encrypted at the application layer with envelope encryption (per-tenant data-encryption keys wrapped by a rotating master key).
• Secrets. Production secrets live in Vercel and Supabase Vault. No service-role key has ever been bundled into a client artifact. Our build pipeline fails CI if the bundle contains SUPABASE_SERVICE_ROLE.
• Backups. Daily encrypted backups for 30 days; weekly for 90; monthly for 1 year. Restore drills quarterly.

Production incidents are tracked in a public-facing status page (link below). Severity 1 incidents (data exposure, cross-tenant leak, prolonged auth outage) trigger a same-day post-mortem published within 5 business days; we email affected users within 72 hours of confirmation. We follow GDPR Article 33 notification timelines and the Amazon Selling Partner API security incident reporting protocol where applicable.

Responsible disclosure: send security findings to security@selfpubgo.com with optional PGP key on the keyserver. We respond within one business day. We do not yet operate a paid bug bounty; we will name and credit researchers in our security acknowledgments.