Amazon does not gate restricted roles on how good your software is. It gates them on compliance. We rebuild the exact security and data-handling documentation Amazon scores, aligned into one consistent file, so the reason behind your refusal is gone.
Restricted roles are elevated Selling Partner API permissions that give an approved developer access to Personally Identifiable Information, names, shipping addresses, contact details and order data. Amazon treats this as highly sensitive personal and financial data, so it gates each role behind a Restricted Data Access (RDA) review, and grants it only when your use case and your security posture both check out.
Unlocks the buyer PII you need to ship directly: recipient name, shipping address and contact details, and for Amazon Custom, customer-uploaded photos, personalization text, names and dates. Used to generate carrier-compliant shipping labels, rates and tracking.
For sellers, fulfilment, shipping and Amazon Custom software Direct-to-Consumer Shipping role guide →Unlocks the order and customer data needed to generate compliant tax invoices (VAT / GST) from Amazon order data, for accounting and tax-compliance workflows where they are enabled for authorized users.
For invoicing, ERP and accounting integrations Tax Invoicing role guide →Unlocks the data needed to calculate tax obligations and produce filing-ready outputs that support a merchant's tax-remittance workflow, in line with local tax regulations.
For tax-engine and compliance tools Tax Remittance role guide →Unlocks the buyer PII needed to deliver an add-on service in person, assembly, installation, repair or maintenance: the customer's name, service (home) address, contact number and appointment details. Used to schedule jobs, assign technicians and manage appointments through Amazon's Services API.
For installers, assemblers and field-service software Professional Services role guide →Amazon's four restricted (PII) roles are Direct-to-Consumer Shipping, Professional Services, Tax Invoicing and Tax Remittance. Each is judged on its own justification, they are not interchangeable, and the reviewer weighs the roles you request against your use case and Amazon's official role definitions together. We also prepare related roles such as Buyer Communication and Buyer Solicitation on request.
Amazon rarely tells you what went wrong. The decision almost always comes down to one phrase, your security and compliance documentation did not meet requirements. In practice, that means one or more of these:
Amazon reviews evidence, not promises. We remove every one of these reasons, so there is no compliance ground left to refuse you on.
A restricted-role review is a security and data-protection assessment. We align your file to every control Amazon evaluates, and tell you in plain language what to have in place. We never need access to your systems to do it. These controls map to Amazon's Acceptable Use Policy (AUP), Data Protection Policy (DPP) and Key Security Control Guidance, as published as of June 2026.
PII kept no longer than 30 days after delivery, used only to fulfil orders or as required by law, then securely deleted (per NIST 800-88).
TLS 1.2 or higher in transit (TLS 1.3 recommended); AES-128 or higher at rest (AES-256 recommended) with RSA-2048 or higher; a key management system (KMS) with at least annual key rotation, and encrypted backups.
Least-privilege access, unique per-employee IDs, multi-factor authentication, quarterly access reviews and prompt offboarding.
Activity logs kept for at least 12 months with alerting, keeping customer PII out of logs unless legally required.
A written runbook with roles and escalation, and notification to Amazon within 24 hours of a suspected breach.
Amazon's official OAuth, Login with Amazon (LWA), only. You never request, accept or store a seller's Seller Central or Vendor Central credentials.
It depends on who uses your software. We prepare both, and we tell you which one fits before you spend a euro.
For a tool used only inside your own business, on your own seller account. The review is documentary, built on two things: your application answers and your public Data Handling & Privacy Policy. It removes the heaviest requirements that exist to police multi-seller platforms, which makes it a genuinely simpler case.
For SaaS, ERP, WMS, OMS and integrators offering a tool to multiple Amazon sellers. Far harder: a business-criteria review, additional security questions, and a live security-architecture review with an Amazon solution architect, as a Data Security Assessment (DSA) across twelve domains (listed below). We have taken a public app through it and passed on the first attempt.
If your app is public, Amazon's mandatory Data Security Assessment (DSA) is run by an Amazon-authorised agent at no cost, and evaluates these twelve domains. We prepare your evidence for every one of them.
The assessment takes about a month and roughly 8 hours of your team's time (around 4–6 hours of written responses, a 2-hour call, and about 2 hours of follow-up). Private, single-seller apps do not go through the DSA.
Not advice and not a template. Three finished, copy-paste-ready deliverables, plus everything around them, aligned to Amazon's Acceptable Use Policy (AUP), Data Protection Policy (DPP) and Developer Agreement.
Every answer Amazon asks for, written for you: the questionnaire plus the free-form security and architecture responses, within Amazon's character limits.
A ready-to-publish policy page for your website, covering collection, processing, storage, use, sharing and disposal. One of the two things Amazon checks for a private app.
Every control Amazon requires, written so your IT lead can put it in place point by point, with no guesswork about what "compliant" means.
A tailored purpose, legal basis and retention period for each restricted role you request, because Amazon judges each one separately.
A runbook covering roles, incident types, escalation and the 24-hour notification to Amazon, ready to attach and to follow.
We answer Amazon's follow-up questions, and if the first attempt is declined we revise the file on their feedback, across up to three attempts.
We are a marketplace-compliance firm, not a development agency. We do not need access to your application, your source code, your servers or your Amazon account. We prepare the documentation and the application; your own IT lead implements the checklist on your infrastructure.
Knowing exactly what Amazon expects, and how to present it, is our field. Implementing it on your systems is where your IT lead is strongest. Most of the checklist is documentation and configuration. The few items that can need a developer, an automated 30-day deletion routine, keeping PII out of logs, connecting through Amazon's OAuth instead of storing credentials, are small tasks, not a rewrite.
A restricted-role application is won on compliance and consistency, the parts most applicants underestimate until Amazon comes back with questions, or with nothing at all.
| The application | On your own | With Fenchell |
|---|---|---|
| Building the case | ||
| Every application answer written for you | ||
| A role-by-role justification for the PII you request | ||
| A Data Handling & Privacy Policy that meets Amazon's standard | ||
| One consistent story across the whole file | ||
| Meeting the security bar | ||
| A plain-language checklist of every control Amazon scores | ||
| An incident-response plan ready to attach | ||
| When Amazon pushes back | ||
| Follow-up questions answered for you | ||
| The file revised across up to 3 attempts | ||
There are three ways to approach a restricted-role application, and only one is built for this exact problem.
Free, but you learn Amazon's compliance bar by being rejected. Most teams underestimate the documentary consistency and the security evidence, and lose weeks to repeated refusals.
Strong at code, but this is rarely a coding problem. Agencies bill hours to build features Amazon never asked for, while the real blocker, the compliance file, stays unaddressed.
We bill an outcome, not time. You get the exact compliance file Amazon scores, answers, policy page and checklist, aligned to its policies, with no access to your systems.
We start from a short form, build your complete compliance file, and stay with you through Amazon's review.
Tell us which roles you want, whether your software is for your own company or for many sellers, any previous attempt, and how your business works. A screenshot of your current Amazon application page and a look at your website are all we need to start.
We review your case the way an Amazon reviewer does and assemble the complete file: every application answer, your Data Handling & Privacy Policy page, your implementation checklist, and a justification for each role.
Your IT lead implements the checklist and publishes the policy page, you submit the prepared answers, and we handle Amazon's follow-up questions, revising the file across up to three attempts if needed.
What you can hold us to from the first message to the last day of follow-up.
Guidance tailored to your account, your software and your roles is part of the service, not an add-on.
Your complete compliance file is delivered within 48 hours of payment reaching us.
If the access is not obtained, you are refunded subject to the terms of our T&Cs.
If Amazon declines, we revise the file on their feedback across up to three submission attempts.
We never need your code, servers or Amazon login. We prepare the file; your team keeps full control.
Our team is on your case Monday to Friday, 9am–6pm EEST, throughout the process.
Share which restricted roles you want, whether your app is private or public, and how your business works. We review it the way Amazon will, and come back with your complete compliance file.
Real client outcomes since 2018, and a refund policy that puts the risk on us, not on you. As an Amazon Marketplace EU Agency Partner with a dedicated Key Account Manager, and a verifiable member of Amazon's Service Provider Network (SPN), we work inside Amazon's own partner ecosystem.
Developer accesses and restricted roles unlocked for real clients through our structured, document-backed process.
Of our customers obtained their access. Amazon keeps the final decision, so outcomes are never guaranteed, which is why the risk sits with us.
We prepared a multi-channel e-commerce platform for the hardest tier, a public application with a full security assessment, and it passed on the first attempt.
A full refund if a technical issue occurred on our side, and a partial refund if Amazon questions your business legitimacy, per our T&Cs.
Best Service. “Getting approved for access to the Amazon API was a real challenge for us. Fenchel and their team stepped in, audited our functionality, and helped us understand precisely what Amazon's software review team was looking for — which made all the difference.”
Start the form and we will confirm your roles, your path and your next steps. The standard restricted-role file is 650 €, delivered in 48 hours, obtained or refunded subject to our T&Cs. Building software for many sellers? Book a call for a tailored scope.
Content reviewed by Loïc Segui (COO & CTO), Fenchell's Marketplace Compliance Team · last updated 29 June 2026. We never promise approval: even when your file is prepared correctly, Amazon retains the right not to grant restricted access without justification. The figures shown on this page (accesses obtained, success rate) are based on real client cases and do not constitute a guarantee of outcome; results vary depending on your situation and Amazon's decision. Fenchell Capital OOD, Bulgarian firm based in Plovdiv (EIK 207945095).