Information Security Policy
Purpose
This policy defines how Xscale Lancamentos LTDA ("Xscale") protects the confidentiality, integrity and availability of the information it handles, including data obtained through the TikTok Shop Open API.
Scope
Applies to all Xscale systems, accounts, devices and people with access to them. Today Xscale operates a single internal tool used by its own staff to manage its own TikTok creator account (product selection, showcase, content publishing and affiliate performance). The tool is not offered to third parties.
Roles
Security Owner: Carlos Henrique Ferreira Guimaraes (Managing Partner) is accountable for this program, approves access, owns incident response and is the Data Protection Officer (Encarregado under LGPD). Contact: [email protected].
Principles
- Least privilege and need-to-know for every account and credential.
- Data minimization: we only request the API scopes the tool uses and we do not store TikTok buyer personal data.
- Encryption in transit (TLS 1.2+) for every API call and web page; encryption at rest for secrets and tokens.
- Secrets never in source control: credentials live in local environment files excluded from version control.
- Every change is tested before it reaches production.
Related policies
Network Security, Endpoint Protection, Security Baseline, Access Control, Data Classification and Encryption, Incident Response, Vulnerability Management and Data Protection. All are published at xscalelancamentos.com/security.
Compliance
Xscale complies with the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and with the TikTok Shop Partner terms and data policies. Violations of this policy lead to immediate revocation of access.