Information Security Policy

Version 1.0 · effective 6 August 2026 · reviewed annually

This document sets out how TikShop Pro protects the data of TikTok Shop sellers, subscribers and affiliates. It describes controls that are in place, not intentions: every statement below matches how the system actually works as of the publication date.

1. Scope and accountability

This policy covers every part of the service: the tikshopro.com website, the backend running on Cloudflare Workers, the database, the Chrome extension and all third-party integrations.

TikShop Pro is a small team. Accountability for information security sits with the product owner; it is neither delegated nor split across several people. That means a single decision-maker and no control left unowned.

We do not claim SOC 2, ISO 27001 or PCI DSS certification. Cardholder data never touches our infrastructure at all, so PCI DSS scope does not apply to us — see section 3.

2. Data classification

3. Encryption

In transit. All traffic runs over HTTPS with TLS 1.2 or above; HTTP is redirected to HTTPS at the Cloudflare edge. Calls to third-party APIs (TikTok Shop, Stripe, Resend) use TLS.

At rest. TikTok Shop tokens are encrypted with AES-256-GCM before being written to the database. The encryption key is held separately from the data, in Cloudflare's encrypted secret store. Compromise of the database without the key does not expose the tokens.

Passwords. Affiliate passwords are not stored. We store the output of PBKDF2-HMAC-SHA256 with 100,000 iterations and a unique salt per account. The iteration count is embedded in the hash, so it can be raised without resetting existing passwords.

Payment data. Card details are entered on a Stripe-hosted checkout page and never pass through our infrastructure. We do not receive, process or store card numbers.

4. Access control

• Least privilege: the Stripe key is restricted to the four operations the service needs and cannot move funds out.
• Two-factor authentication is mandatory on every administrative account: Cloudflare, Stripe, the code repository and the domain registrar.
• No shared accounts. Every access is personal and can be revoked individually.
• Dashboard sessions last 30 days; cookies are marked Secure, HttpOnly and SameSite=Lax, so page scripts cannot read them and they are not sent on cross-site navigation.
• Password sign-in locks for 15 minutes after eight consecutive failed attempts.
• Sign-in and password-reset links are single-use, valid for one hour and require a deliberate action to complete — a mail scanner pre-fetching the link does not consume it.
• Access rights are reviewed quarterly and revoked immediately on role change or departure.
• Keys and secrets are rotated at least every 90 days, and immediately on any suspicion of compromise.

5. Architecture and network segregation

The service runs on Cloudflare Workers, a serverless platform. We operate no virtual machines, no containers, no open ports, no SSH access and no internet-facing admin panels. There is no flat network that would need to be carved into segments.

Isolation is achieved differently, and more strictly:

• Execution isolation. Every request runs in its own V8 isolate, with no shared filesystem and no memory shared between requests or between customers.
• Storage isolation. The database has no public network address and is unreachable from the internet. It can only be accessed through a binding from our own code — not via a password that could be guessed or stolen.
• Environment separation. The payment provider's test and live modes use independent key sets and independent data; a key from one environment does not work in the other.
• Secret separation. Encryption keys, API keys and tokens live in the platform's encrypted secret store and never enter version control. An automated check on every code change catches a key committed by accident.
• Extension boundary. The Chrome extension holds no application keys and has no database access. It asks the server for a result; it cannot call TikTok Shop on our behalf, nor reach another user's data.

The perimeter is fronted by Cloudflare's network: DDoS protection and malicious-traffic filtering apply to every request before it reaches the application. API requests are additionally rate-limited per source address; payment-provider webhooks are excluded from that limit so their retries are never blocked and payments are not lost.

6. Threat monitoring

We keep a dedicated security event log. It records events that look like noise in isolation but constitute an attack in aggregate:

• failed sign-in attempts and brute-force lockouts;
• payment webhook requests with an invalid or expired signature — a sign of a forged payment notification;
• TikTok Shop authorization callbacks carrying an unknown or already-used state parameter — a sign of an attempt to attach someone else's shop.

Critical events are delivered to the accountable person immediately over a separate notification channel. Alerts are rate-limited per event type: a flood of identical messages buries the next genuine alarm, so a summary with a repeat count is sent instead of every individual event.

Log entries are retained for 90 days and deleted automatically on a schedule. We do not keep IP addresses longer than an incident investigation requires.

We do not claim a 24/7 security operations centre. Alerts are delivered immediately, at any hour; human response follows the timelines in section 10.

7. Endpoint protection

Every workstation runs with full-disk encryption (FileVault or BitLocker), built-in malware protection (Gatekeeper and XProtect on macOS, Microsoft Defender on Windows), automatic operating-system updates, and automatic screen lock after no more than five minutes of inactivity.

8. Vulnerability management

Dependencies are scanned automatically on every code change and weekly on a schedule: a vulnerability appears when it is published, not when the code is committed. A separate check catches keys or tokens committed by accident. Alerts are triaged on receipt.

External vulnerability reports are accepted at security@tikshopro.com.

9. Secure development

• All code is kept under version control with a complete, immutable change history.
• Automated tests cover webhook signature verification, password hashing and brute-force protection, single-use authorization tokens and seller-token encryption. The suite runs before every deployment.
• The backend has no third-party runtime dependencies. This removes an entire class of supply-chain risk: a compromised package cannot reach our code, because there are no packages.
• Secrets never enter the repository — whether it is public or private. Closed source is not treated as a control: a key that has once appeared in commit history is considered compromised and is rotated.
• External data is never executed as code. The extension does not load executable code from the server — only data.

10. Incident response

An incident is any event where data may have been exposed, altered or lost, as well as the compromise of any key or account.

1. Containment — within 24 hours of detection. Revoke compromised keys and tokens; disable the affected feature if necessary.
2. Assessment — within 72 hours. Establish which data and which people were affected, using the event log.
3. Notification — within 72 hours of confirmation. Affected sellers, users and platforms, including TikTok Shop, are notified directly. We do not delay notification until the investigation is complete.
4. Remediation and review. The root cause is fixed rather than masked, and a test or control is added to prevent recurrence.

All keys and secrets are rotated immediately on any suspicion of compromise, without waiting for confirmation.

11. Data retention and deletion

• TikTok Shop tokens are kept until the seller revokes access, and are deleted on revocation.
• Security logs: 90 days, then automatic deletion.
• Subscription records are kept while the account is active and for as long as tax and accounting law requires.
• Deletion requests are fulfilled within 30 days. Send them to the address in section 14.

12. Third-party processors

We share data only with providers the service cannot run without, and only to the extent required:

TikTok Shop seller data is not shared with third parties, not sold, and not used to train models.

13. Business continuity

The infrastructure is distributed across Cloudflare's network; the failure of a single node does not take the service down. The database supports platform-provided point-in-time restore. Source code and database schema are held in version control, so the service can be rebuilt from scratch.

14. Policy review and contact

This policy is reviewed annually, and additionally whenever the architecture or the categories of data processed change materially. The version and effective date appear at the top of this document.

Vulnerability reports and security questions: security@tikshopro.com. Personal data and deletion requests: privacy@tikshopro.com. Everything else: support@tikshopro.com.

Vulnerability reports are welcome. We will not pursue researchers acting in good faith: those who do not extract more data than needed to demonstrate a finding, do not disrupt the service, and allow reasonable time to fix before disclosure.

← Back to home