Information Security Policy

1. Purpose and scope

This policy sets the security requirements for ValueInfluence LLC ("the Company") when operating Creator Outreach, our private TikTok Shop Partner application, and any company device, account or system that stores or processes data obtained through TikTok Shop APIs on behalf of the sellers we serve. It applies to all employees, contractors and anyone given access to these systems.

2. Roles and responsibilities

• Security Owner / Incident Lead: the Company owner. Approves access, maintains this policy, leads incident response.
• Administrators: manage user accounts and roles in Creator Outreach.
• All users (BD and Fulfillment roles): follow this policy, protect their credentials, and report suspected incidents immediately.

3. Access control

• Access is granted on the principle of least privilege and only for business need.
• Every user has an individual account; shared accounts are prohibited. Passwords must be at least 8 characters and are stored only as bcrypt hashes.
• Creator Outreach enforces role-based access (Admin, BD, Fulfillment). Only Admins can add users, change roles or deactivate accounts.
• Sessions use httpOnly cookies and expire after 30 days. Deactivating a user revokes all of their sessions.
• Access must be removed within 1 business day when a person leaves or no longer needs it.
• Administrators shall review all access quarterly and remove anything no longer required.
• TikTok Shop app credentials (app key, app secret) and seller access tokens are stored only in the server environment configuration, excluded from source control, and are never written to logs or shared by email or chat.

4. Data classification and encryption

• In transit: all communication with TikTok Shop APIs uses HTTPS/TLS, and every request is signed with HMAC-SHA256.
• At rest: every machine that hosts the application or its database must have full-disk encryption enabled (e.g., FileVault or BitLocker). Backups must be encrypted.

5. Endpoint security and anti-virus

• All company endpoints must run anti-virus / endpoint protection with automatic definition updates.
• Devices must use a screen lock, the operating system firewall, and supported operating system versions.

6. Network security and segregation

• The application is bound to a local or private network; the database is never exposed to the public internet.
• A host firewall must be enabled. Guest devices must use a separate guest network, segregated from systems that host company data.
• Remote access, if needed, must use an encrypted channel (e.g., VPN or SSH).

7. Vulnerability and patch management

• Operating systems and application dependencies are updated at least monthly; critical security patches are applied within 7 days of release.
• A dependency vulnerability scan (npm audit) is run monthly and before each release; high and critical findings must be fixed or formally accepted by the Security Owner.

8. Logging and monitoring

• The application records API call logs containing only the endpoint path, timestamp, HTTP status and a sanitized error message. Credentials, message bodies and full request URLs are not logged.
• Outbound creator messages require human confirmation, are rate-limited per minute and per day, and are preceded by TikTok's outreach-eligibility check.
• Logs are reviewed when unusual activity or errors are reported.

9. Incident response

1. Report: anyone who suspects a security incident must report it immediately to the Incident Lead at info@valueinfluence.com.
2. Contain: the Incident Lead revokes affected credentials or tokens, deactivates compromised accounts and isolates affected systems.
3. Assess: determine what data, which sellers and which creators are affected.
4. Notify: if seller or TikTok Shop data is involved, the Company notifies the affected sellers and TikTok Shop (via a Partner Center ticket) within 72 hours of confirming the breach, describing what happened, what data was involved and the actions taken.
5. Recover and learn: restore services, rotate secrets, and record the root cause and corrective actions.

10. Backup and retention

• Backups are encrypted, stored in the United States, and kept for no more than 30 days.
• Seller and creator data is deleted within 30 days after a seller revokes authorization or the contract ends, and the related access tokens are revoked.

11. Third parties

• TikTok Shop Open APIs: the only source of seller and creator data, used solely with seller authorization and within the granted scopes.
• Optional AI text provider: if enabled, only creator public profile information and the brand description are sent to draft outreach messages; every draft requires human approval before sending. This feature can be disabled.
• The Company does not sell or share data with any other party.

12. Policy review

This policy is reviewed and updated at least annually and whenever systems or legal requirements change. Each version is dated, and the current version is made available to all users.