Seven claims, and the four that are not true yet

You enrol in CBP’s ACE Secure Data Portal yourself, as the importer of record. CBP’s own published guide (Publication 5228-1025, October 2025) puts it at about ten minutes. Inside your own account you schedule the ITRAC Entry Summary Line Tariff Details report as a recurring CSV, sent to an address you choose — which can be ours. You delete the schedule and it stops. There is no power of attorney, no filer code, no shared password, and no CBP credential of yours anywhere in our systems. The report is produced by the government, inside your account, on your instruction, and the only thing we ever hold is the CSV you decided to send us.

We will hold six non-restricted roles and no others. We did not request Direct-to-Consumer Shipping, Professional Services, Tax Invoicing or Tax Remittance — the four roles that carry personal data — so buyer names, addresses and contact details are not something we have chosen not to look at. They are something Amazon will not give us. Adding a role later would force every existing customer to re-authorise, which is precisely why the list is published here before there is anyone to publish it to.

People ask for this, and we understand why. But the only version of self-hosting that Amazon’s rules actually permit is one where YOU register your own developer application, wait weeks for your own roles to be approved, and then become the permanent custodian of a client secret — with no rotation tooling and no revocation screen. Amazon’s Data Protection Policy requires credentials to be rotated at least annually and forbids hardcoding them. A customer-held secret on a customer-run box fails both. We are asking you to hold fewer secrets, not more. Note that claim 01 already gives you the thing self-hosting is usually asked for: the customs data path has no credential in it anywhere.

Authorisation is an OAuth click inside Seller Central. You never hold, type, paste, store or rotate a secret — there is no field to put one in, because there is nothing to put — and you revoke it yourself in two clicks at Apps & Services → Manage Your Apps, without asking us and without telling us. Amazon’s consent screen, not our marketing, is what enumerates the access.

One Postgres database, one database role and one AES-256-GCM data-encryption key per customer, each key wrapped by a master key held separately. There will be no tenant_id column to get a WHERE clause wrong on, because there will be no shared table. A multi-tenant competitor cannot retrofit this cheaply, which is rather the point — and it is far easier to build this way from zero customers than to migrate to it from a thousand.

From launch, a full database dump will land every week in the S3 or R2 bucket you nominate, encrypted to your own key. On every tier, at no extra cost, for the life of the subscription. The point is that when you leave you already have your data — nothing to request, no ticket to raise, no 30-day clock to run down. It is unconditional deliberately: an export you have to ask for is a retention lever, and we would rather not own one.

Landed cost, duty and trade remedies, the purchase-order ledger, customs-entry reconciliation, container tracking and cash flow are designed to run entirely on your own documents and on published government tariff data, in a physically separate database schema from anything Amazon-derived. If our Amazon access were suspended, those screens would not notice. The Amazon-derived screens — units sold, fees, ad spend, net proceeds, stock position — would stop. That list is exhaustive and we will not add to it quietly.