This policy sets out how ADSMCP AI LLC (“we”), the company that operates GMVize, detects, handles and reports security incidents, including personal data breaches. It works together with our Information Security Policy and Data Protection Policy.
1. What counts as an incident
A security incident is any event that compromises, or could compromise, the confidentiality, integrity or availability of GMVize systems or data. Examples: a leaked secret or access token; unauthorised access to a GMVize account or to customer data; a lost or stolen company device; malware on a company device; a vulnerability being exploited; data sent to the wrong customer.
A personal data breach is an incident that leads to the accidental or unlawful destruction, loss, alteration, disclosure of, or access to personal data.
2. Roles
- Incident lead (the founder): decides severity, coordinates the response, makes notifications and writes the incident record.
- Anyone who notices a possible incident — staff, a customer, a researcher — reports it straight away. Reporting a false alarm is never a problem.
3. How to report
- Email security@gmvize.com, monitored daily. We acknowledge reports within 2 business days, and the same day for suspected breaches of customer data.
- TikTok Shop can also reach us through the Partner Center contact for our app.
4. Severity
| Level | Meaning | Response starts |
|---|---|---|
| Critical | Confirmed or likely access to customer data or TikTok Shop tokens; secrets exposed | Immediately |
| High | Service unavailable or a vulnerability that could expose customer data | Within 4 hours |
| Low | Suspicious activity with no evidence of impact | Within 2 business days |
5. Response steps
- Contain. Stop the harm first: rotate exposed secrets, revoke affected sessions and TikTok Shop tokens, disable the affected feature or take the app offline if needed, and lock lost devices.
- Assess. Work out what happened, which shops and data were affected, since when, and whether personal data was involved. Preserve logs and evidence.
- Notify as described in section 6.
- Eradicate and recover. Fix the root cause, restore from backup if data was altered, and confirm the fix before returning to normal operation.
- Review. Within 14 days, write a short post-incident record: timeline, cause, impact, notifications made and the changes we will make.
6. Notification
- TikTok Shop: we notify TikTok Shop of a suspected or confirmed incident affecting TikTok Shop data without undue delay, and in any case within 72 hours of becoming aware of it.
- Affected sellers: we notify sellers whose data is affected without undue delay and within 72 hours, by the email address they gave us, describing what happened, what data was involved, what we have done and what they should do.
- Regulators: where the law requires it — for example the UK Information Commissioner's Office for a qualifying personal data breach — we notify within the legal deadline, normally 72 hours.
- If not all facts are known within 72 hours, we send what we know and update as we learn more.
7. Records and testing
- Every incident, including low-severity ones and decisions not to notify, is recorded and kept for at least 3 years.
- We test this policy at least once a year with a tabletop exercise (for example, “the token encryption key has leaked”) and update it with what we learn.