Network Protection: 

1. Custom Catch developers have active, in force, AES-128 encryption, network segmentation, access control lists and a network firewall to deny access to unauthorized IP addresses. All public access is denied. 
2. Custom Catch developers are assigned a unique ID/Keys/Authentication to control and monitor computer access to Amazon Information and developers cannot create or use generic, shared, default login credentials or user accounts. All access/authorization is controlled by the Custom Catch President.
3. Custom Catch developers have active, in force, baseline mechanisms to ensure that at all times only the required user accounts can access Amazon Information. 
4. The Custom Catch President, solely reviews the authorized list of people and services with access to Amazon Information on a monthly basis, and removes accounts that no longer require access. 
5. Custom Catch developer employees are restricted from storing Amazon data on USB, flash memory or any other personal devices. 
6. Custom Catch developers maintain and enforce "account lockout" by detecting anomalous usage patterns and log-in attempts and disable accounts with access to Amazon Information as needed.
7. Custom Catch developers have, in force, TLS or SFTP encryption for all Amazon Information in transit within, but not limited to our network or between hosts. 
8. Custom Catch developers enforce this security control on all applicable external endpoints used in internal communication channels including, but not limited to data propagation channels among storage layer nodes, connections to external dependencies and operational tooling. 
9. Custom Catch developers disable communication channels which do not provide encryption in transit even if unused, including, but not limited to removing the related dead code, configuring dependencies only with encrypted channels, and restricting access credentials to the use of encrypted channels. 
10. Custom Catch developers will use data message-level encryption such as AWS Encryption SDK where channel encryption such as SFTP, or TLS terminates in untrusted multi-tenant hardware such as untrusted proxies.

Data Retention and Recovery: 

1. Custom Catch developers retain PII only for the purpose of, and as long as is necessary to fulfill orders, but no longer than 30 days. At the time of order fulfillment, but in all cases, less than 30 days, Custom Catch deletes all PII from its database, systems and devices. Custom Catch does not retain any archival copies of Amazon Information.

Data Governance:

1. Custom Catch developers create, document, and abide by the Custom Catch privacy and data handling policy for their Applications or services which govern the appropriate conduct and technical controls to be applied in managing and protecting information assets. 
2. Custom Catch developers keep inventory of software and physical assets with access to PII, and update this inventory at least on a quarterly basis. A record of data processing activities such as specific data fields and how they are collected, processed, stored, used, shared, and disposed for all PII Information is maintained to establish accountability and compliance with regulations. 
3. Custom Catch developers have established and abide by the Custom Catch privacy policy for customer consent and data rights to access, rectify, erase, or stop sharing/processing their information where applicable or required by data privacy regulation.

 Encryption and Storage: 

1. Custom Catch developers encrypt all PII at rest including, but not limited to, when the data is persisted, using industry best practice standards by using AES-128 encryption. All cryptographic materials including, but not limited to encryption/decryption keys and cryptographic capabilities, daemons implementing virtual Trusted Platform Modules and providing encryption/decryption APIs used for encryption of PII at rest are only accessible to the Custom Catch developer's processes and services. 
2. Custom Catch developers do not store PII in removable media including, but not limited to USB, unsecured public cloud applications and/or public links made available through Google Drive.
3. Custom Catch developers securely dispose of any printed documents containing PII.

 Least Privilege Principle:

1. Custom Catch developers implement fine-grained access control mechanisms to allow granting rights to any party using the Application including, but not limited to access to a specific set of data at its custody and the Application's operators with access to specific configuration and maintenance APIs such as kill switches following the principle of least privilege. Application sections or features that vend PII are protected under a unique access role, and access is only granted on a "need-to-know" basis.

 Logging and Monitoring:

1. Custom Catch developers gather logs to detect security-related events including, but not limited to access and authorization, intrusion attempts or configuration changes to their Applications and systems. 
2. Custom Catch developers have, in force, this logging mechanism on all channels including, but not limited to service APIs, storage-layer APIs or administrative dashboards providing access to Amazon Information. All logs have, in force, access controls to prevent any unauthorized access and tampering throughout their lifecycle. Logs themselves do not contain PII and are retained for at least 90 days for reference in the event of a Security Incident. 
3. Custom Catch developers have, in force, mechanisms to monitor the logs and all system activities to trigger investigative alarms on suspicious actions, including, but not limited to, multiple unauthorized calls, unexpected request rate and data retrieval volume, or access to canary data records. 
4. Custom Catch developers perform an investigation when monitoring alarms are triggered. This event is documented in the Developer's Incident Response Plan.

Audit

1. Custom Catch developers maintain all appropriate books and records reasonably required to verify compliance with the Acceptable Use Policy, Data Protection Policy, and Amazon Marketplace Developer Agreement during the period of agreement and for 12 months thereafter. 
2. Upon Amazon's written request, Custom Catch developers will certify in writing to Amazon that they are in compliance with these policies.
3. Custom Catch developers will cooperate with Amazon or Amazon's auditor in connection with the audit, which may occur at the Custom Catch developer's facilities. If the audit reveals deficiencies, breaches, and/or failures to comply with Amazon or Amazon’s auditor’s terms, conditions, or policies, Custom Catch, at its sole cost and expense, will take all actions necessary to remediate those deficiencies within an agreed-upon timeframe.