Xscale Lancamentos LTDA

Security Baseline for Daily Operations

Effective date: November 6, 2026 · Owner: Carlos Henrique Ferreira Guimaraes · Reviewed every 12 months or after any material change

Accounts

Multi-factor authentication (MFA) is mandatory on every account that can reach business data: Google Workspace/Gmail, TikTok, TikTok Shop Partner Center, Cloudflare and code hosting.
Passwords are unique per service, at least 12 characters, generated and stored in a password manager. Shared passwords are forbidden.

Devices

Automatic screen lock after 5 minutes of inactivity; manual lock (Win+L) whenever the device is left.
Device login protected by password or Windows Hello.
Clean desk and clean screen: no credentials written on paper, no secrets in screenshots, chats or documents.

Secrets

API keys, app secrets and access tokens are stored only in local environment files excluded from version control, and are never printed in full in logs.
A leaked or suspected secret is rotated immediately in the TikTok Shop Partner Center.

Approved by Carlos Henrique Ferreira Guimaraes, Managing Partner, on November 6, 2026.