04 / SECURITY & COMPLIANCE
Data security built into every engagement
Client and marketplace data is handled under documented controls aligned with TikTok Shop's Data Security and Privacy Review and US Data Security Questionnaire.
- 01
US data residency
Protected data for US clients and marketplaces is stored and processed in US-region cloud infrastructure, with production access limited to US-based staff.
- 02
Encryption
TLS 1.2 or higher for data in transit, AES-256 for data at rest, and managed key storage for secrets and credentials.
- 03
Access control
Administrator MFA, least-privilege roles, access logging, and periodic access reviews across all production systems.
- 04
Data minimization
API scopes limited to documented business purposes, with a maintained data inventory and data-flow documentation.
- 05
Retention and deletion
Defined retention schedules and verified deletion when a seller deauthorizes, a shop disconnects, or an engagement ends.
- 06
Incident response
Documented incident response and breach notification procedures, with annual tabletop exercises and post-incident review.
Security documentation, data-flow diagrams, and policy evidence are available to clients and marketplace partners on request.