Xscale Lancamentos LTDA

Access Control Policy

Effective date: November 6, 2026 · Owner: Carlos Henrique Ferreira Guimaraes · Reviewed every 12 months or after any material change

Least privilege

Access to personal data and to TikTok Shop data is granted only to people whose role requires it, with the minimum permission needed. Today a single administrator (Carlos Henrique Ferreira Guimaraes) has access; any new person needs written approval from the Security Owner, an individual account and MFA.

API scopes

The application requests only the TikTok Shop scopes it uses (creator product search, showcase, content posting and affiliate order reporting). Unused scopes are removed.

Credentials and tokens

Access tokens are bound to our own creator account, stored encrypted (AES-256-GCM) on the operator workstation and refreshed through the official OAuth flow.
OAuth requests use a single-use random state value to prevent request forgery.

Review and revocation

Access is reviewed every quarter and revoked the same day a person leaves or no longer needs it. Revoking the app authorization in TikTok invalidates every token.

Approved by Carlos Henrique Ferreira Guimaraes, Managing Partner, on November 6, 2026.