Security
AliTok Information Security Program
This page describes the administrative, technical, and organizational controls AliTok uses to protect seller and operational data processed through the platform.
Last updated: July 10, 2026
Program commitments
- Maintain written security and privacy documentation that is reviewed after material platform changes.
- Restrict access to customer and seller data based on role, operational need, and tenant membership.
- Use managed infrastructure, encryption protections, and credential handling practices appropriate for a small SaaS platform.
- Investigate security reports promptly and communicate confirmed incidents to affected parties when required.
Access control
AliTok requires authenticated access for application users, verifies bearer tokens on protected API routes, and limits organization data access to active members of the relevant workspace.
- Supabase authentication is used for user identity and session management.
- Protected API routes verify tokens before processing requests.
- Organization access checks enforce tenant separation.
- Administrative access is limited to named operators and should use MFA-enabled accounts.
Application and infrastructure security
AliTok is deployed on managed cloud infrastructure and uses platform-level controls to reduce exposure of sensitive operational data.
- Traffic is served over HTTPS.
- Server-side secrets are kept in environment configuration and not exposed to client code.
- Debug and test endpoints are disabled in production by middleware.
- Scheduled jobs require a separate authorization secret before execution.
- TikTok webhooks are signature-verified before processing.
- New and backfilled TikTok access/refresh tokens use a dedicated server-managed encryption key; pilot readiness blocks cutover until encryption is configured, and the TikTok app secret is not persisted as tenant data.
Data protection
AliTok follows least-privilege and tenant-isolation principles when handling user, organization, product, and order data.
- Supabase Row Level Security is used on tenant-sensitive tables.
- Server routes use secret-scoped database credentials only when required.
- Contact requests are rate-limited and persisted for operational follow-up.
- Connected platform data is processed only for seller-authorized workflows.
- TikTok buyer contact and address fields are masked in normal responses; owner/admin reveal is no-store and recorded in the organization activity log.
Endpoint and operational security
AliTok maintains baseline security requirements for operator-managed endpoints and day-to-day administration.
- Production administration is performed only from approved operator devices.
- Workstations should use screen locking, password protection, OS security updates, and anti-malware protection.
- Shared credentials are prohibited.
- Secrets must be rotated if unauthorized access is suspected.
Incident response and breach notification
AliTok maintains a documented process for handling suspected security incidents, including credential compromise, unauthorized access, webhook abuse, and accidental disclosure. The standard response flow is:
- Triage incoming reports and classify severity.
- Contain affected access, credentials, endpoints, or integrations.
- Investigate scope, impacted data, and required remediation.
- Notify affected partners or users without undue delay when a reportable event is confirmed.
- Document corrective actions and update controls after the incident is closed.
TikTok Shop pilot boundaries
TikTok Shop production functionality is staged for a controlled US pilot. Readiness checks cover the intended mode, granted scopes, webhook health, LDR verification, SKU mappings, and inventory freshness. Automatic inventory and confirmed-tracking writes are separate per-organization controls and default off.
A disconnect immediately disables the integration and wipes stored TikTok access and refresh tokens, then queues deletion of TikTok-sourced operational rows from AliTok's primary application database. Provider copies, delivered email, infrastructure logs, observability systems, and backups follow their own retention/deletion procedures and are not proven erased by the local database receipt.
Security contact
AliTok accepts support, privacy, and security requests through the public support channel. Security and privacy requests are triaged manually by the platform operator.