This policy sets out how ADSMCP AI LLC (“we”), the company that operates GMVize, protects the systems and data it is responsible for, including data from TikTok Shop accounts our customers connect. It applies to everyone who works on GMVize, to every system that stores or processes GMVize data, and to the providers we rely on. GMVize is currently run by its founder, who holds every role named in this policy.
1. Roles and responsibilities
- Security owner (the founder): owns this policy, approves access, runs the reviews below and leads incident response.
- Anyone given access in future (employees or contractors) must accept this policy in writing before access is granted, and complete the onboarding in section 4.
2. Systems in scope
We keep an inventory of the systems that hold GMVize code or data and review it every quarter. Today it is:
- Cloudflare — hosting of gmvize.com and the GMVize application (Cloudflare Workers), the application database (Cloudflare D1), DNS and edge security.
- GitHub — source code.
- TikTok Shop Partner Center — app configuration and credentials.
- Company endpoint — the computer used to develop and operate GMVize.
3. Network and infrastructure security
- GMVize has no office network or self-managed servers. The application runs on Cloudflare's serverless platform, which provides network isolation between customers, DDoS mitigation and a web application firewall at the edge.
- Production is separated from development. Development uses TikTok Shop sandbox shops and a local environment with test data; production credentials are never used for testing.
- All traffic to gmvize.com is served over HTTPS (TLS 1.2 or higher). Plain HTTP is redirected to HTTPS.
- Administrative endpoints require a separate secret token and never return access tokens or secrets.
4. Endpoint security and security baseline
- Company work is done only on devices dedicated to ADSMCP AI LLC. Devices owned by third parties, including any employer of our staff, are not used for GMVize.
- Company devices must have: full-disk encryption turned on; operating-system malware protection active (on macOS, XProtect and Gatekeeper) and kept up to date; automatic security updates turned on; the firewall turned on; and the screen locking automatically after no more than 5 minutes of inactivity.
- Every account that can reach GMVize systems or data (Cloudflare, GitHub, TikTok Shop Partner Center, domain registrar, email) must use multi-factor authentication.
- Passwords are unique per service, at least 12 characters, and stored in a password manager. Passwords and secrets are never written down or shared in chat or email.
- Clear-screen and clear-desk practice: screens are locked when unattended, and no customer data is printed.
- A lost or stolen device is treated as a security incident (see our Incident Response Policy); all sessions and credentials it held are revoked.
5. Access control
- Access follows least privilege: a person or system gets only the access needed for its task. Today only the founder has access to production systems and data.
- Customer data is accessed only to operate the service, to provide support the customer asked for, or to investigate an incident. It is never browsed out of curiosity.
- Access is reviewed every quarter and removed the same day it is no longer needed.
- Application secrets (the TikTok Shop app secret, the token encryption key and the admin token) are stored only as encrypted Cloudflare secrets. They are never committed to source code or logs, and are rotated at least once a year and immediately if exposure is suspected.
- Customers sign in only through TikTok Shop's authorization flow. Sessions use secure, HTTP-only cookies and expire after 30 days.
6. Data classification and encryption
| Class | Examples | Handling |
|---|---|---|
| Restricted | TikTok Shop access and refresh tokens; application secrets | Encrypted at the application layer with AES-256-GCM before storage, in addition to provider encryption; never displayed, exported or logged |
| Confidential | Shop data: shop identifiers, affiliate orders and amounts, collaborations, sample requests, messages sent through GMVize | Stored only in the application database; used only for the shop that authorized us; never shared between customers; deleted as described in our Data Protection Policy |
| Internal | Source code, configuration, operational notes | Kept in private repositories with access limited to staff |
| Public | Website content, public creator profile fields shown on TikTok | No restrictions beyond accuracy |
- In transit: all connections between users, GMVize, Cloudflare and TikTok Shop use HTTPS.
- At rest: Restricted data is encrypted by GMVize with AES-256-GCM before it is stored; the encryption key is held separately as a Cloudflare secret. All data is stored on Cloudflare's infrastructure under its security programme.
- We collect only the data our features need. We do not store buyers' names, addresses, contact details or payment details.
7. Vulnerability and threat management
- The GMVize application has no third-party runtime libraries, which keeps its attack surface small. Build tools are kept up to date and checked for known vulnerabilities before each release. Critical vulnerabilities are fixed within 7 days, high within 30 days, others in the next planned update.
- We follow security advisories from Cloudflare, TikTok Shop and the libraries we use.
- Changes are reviewed before deployment against a short checklist: input validation, output encoding, access checks, no secrets or personal data in logs.
- Anyone can report a vulnerability to security@gmvize.com. We acknowledge reports within 2 business days.
8. Logging, monitoring and backup
- Application errors and security-relevant events (sign-ins, authorization changes, admin actions) are logged without tokens, secrets or message contents, and reviewed when alerts fire and at least weekly.
- The database provider keeps point-in-time recovery history for up to 30 days. This is also the longest that deleted data can persist in backups.
9. Service providers
We use only established providers with published security programmes, review their security and privacy terms before use, and list the providers that process personal data in our Privacy Policy.
10. Review and exceptions
This policy is reviewed at least once a year and after any significant incident or change to how GMVize is built. Exceptions must be approved by the security owner, recorded with a reason and an end date, and kept as short as possible. Related policies: Incident Response Policy and Data Protection Policy.