Last updated: August 2026
DeskPull moves your Amazon reports from Amazon's servers to your computer. This page explains, in plain language, how we keep that path and your account safe. For how we handle personal information, see our Privacy Policy.
This is DeskPull's core design decision, not an add-on. When a report is ready, the DeskPull app on your computer downloads it directly from Amazon over an encrypted connection and converts it locally. Our cloud coordinates schedules and timing; it only ever sees file names, sizes, and statuses. There is no copy of your sales, inventory, or advertising data on DeskPull's servers to breach, sell, or leak.
DeskPull requests only the Amazon API roles it needs to fetch your reports. We hold no roles that grant access to buyer personal information, and we have declined the ability to pass restricted data to other developers. When you disconnect an Amazon account, its stored authorization is deleted from our systems within 30 days, and you can delete your DeskPull account and its data at any time.
All traffic between the app, our cloud, and Amazon uses TLS 1.2 or higher. The Amazon authorization tokens our cloud holds are encrypted at rest with keys managed in AWS Key Management Service, and the app stores its session credentials in your operating system's keychain, never in plain files.
Every internet-facing DeskPull API endpoint sits behind a web application firewall that filters malicious traffic before it reaches us, and our servers refuse requests that try to walk around it. Sign-in attempts are rate limited, and abusive sources are blocked automatically.
DeskPull for macOS is signed with our Apple Developer ID and notarized by Apple; DeskPull for Windows is code signed. Updates install automatically, and every update is cryptographically verified against our signature before it runs. New releases roll out gradually so problems are caught while small, and the app can restore itself to a known-good version if an update ever misbehaves.
We run automated crash reporting with sensitive values stripped before anything leaves your machine, scan our dependencies for known vulnerabilities on a continuous schedule, and maintain a documented incident response plan with a designated security contact. Our practices align with Amazon's Data Protection Policy for solution providers.
If you believe you have found a security issue in DeskPull, we want to hear about it. Email [email protected] with the details and we will respond promptly. Please do not test against accounts or data that are not your own.