Information security policy

Version 1.0, effective September 14, 2026. Approved by the managing member of DB3 LLC, doing business as EBC Studio. Published at ebc.studio/security. Reviewed at least once a year.

• 1. Purpose and scope
• 2. Roles
• 3. Systems in scope
• 4. Data classification
• 5. Access control
• 6. Credentials and secrets
• 7. Encryption
• 8. Network security
• 9. Secure development
• 10. Third-party APIs and data
• 11. Logging and monitoring
• 12. Vulnerability and threat management
• 13. Incident response
• 14. Backup and continuity
• 15. Vendors
• 16. Endpoint security and daily baseline
• 17. Review

1. Purpose and scope

This policy sets the rules DB3 LLC follows to protect the confidentiality, integrity, and availability of the information handled by EBC Studio software. It covers every system we operate, every person who has access to them, and every piece of data we hold, including data obtained from TikTok Shop under a creator’s authorization. It is a working document, written to be followed in daily operations and audited against.

2. Roles

• Security lead: the managing member of DB3 LLC. Owns this policy, approves access, handles incidents, and reviews vendors.
• Operators: engineering and operations personnel with production access. Each has an individual account on every system and is bound by this policy.
• Creators: the people whose data we hold. They control the TikTok Shop connection and can revoke it at any time.

3. Systems in scope

4. Data classification

5. Access control

• Least privilege: each person and each system component gets only the access its job requires. Scheduled jobs authenticate with a dedicated secret and can reach only their own endpoints.
• Individual accounts for every team member on Vercel, Neon, GitHub, and the TikTok Shop Partner Center. No shared logins to infrastructure.
• Multi-factor authentication is required on every provider account that supports it.
• The creator studio requires a login; sessions are signed cookies that expire after 90 days and are invalidated when the studio password is rotated.
• Administrative and data-reading endpoints are never publicly reachable; they require an authenticated session or the job secret.
• Access is reviewed whenever a person joins or leaves and at the annual policy review. Access is removed the same day a person leaves.

6. Credentials and secrets

• All secrets live in the hosting provider’s encrypted environment configuration. Database connection strings are additionally marked sensitive so they cannot be read back even by administrators.
• Secrets are never committed to source control. Repositories are private and reviewed for accidental exposure.
• TikTok Shop app secrets and access tokens are used only server-side. Tokens are refreshed automatically before expiry and deleted immediately when a creator revokes access.
• A secret that may have been exposed, for example pasted into a chat or a screenshot, is rotated at the provider and replaced in configuration as soon as the exposure is noticed.

7. Encryption

• In transit: all traffic to our websites, APIs, database, and third-party APIs uses TLS 1.2 or higher. HTTP is redirected to HTTPS and HSTS is enabled.
• At rest: the database and hosting provider encrypt storage at rest. Backups inherit that encryption.
• Requests to TikTok Shop are signed with HMAC-SHA256 using the app secret, as the platform requires, so requests cannot be forged or replayed by a third party.

8. Network security

EBC Studio runs entirely on managed, serverless infrastructure. We operate no servers, offices networks, or VPNs of our own, so segregation and perimeter defence are enforced by architecture and by our providers rather than by firewall rules we maintain by hand.

• Segregation. Public websites, the creator studio application, and the database are separate systems with separate credentials. The database is not reachable from the public internet without its connection credentials over TLS, and only the studio’s serverless functions hold those credentials. Static public sites hold no credentials at all. Production and preview environments use separate configuration.
• Function isolation. Each request to the studio runs in an isolated, short-lived serverless execution with no persistent host, which limits lateral movement and removes the class of long-running-host compromises.
• Edge protection. The hosting provider’s edge network terminates TLS, applies DDoS mitigation and rate limiting, and blocks malformed requests before they reach application code. DNS is served by a provider with DNSSEC and DDoS protection.
• Application controls. Every private endpoint requires an authenticated session or a job secret; there are no open administrative interfaces. Security headers deny framing and content-type sniffing and enforce HTTPS. Outbound calls go only to the named third-party APIs over TLS.
• Monitoring. Provider request logs, error aggregation, and the studio’s own health check and job alerts surface unusual traffic, failed authentication, and integration failures to the operations team.

9. Secure development

• Changes are made in source control, built and type-checked before deployment, and deployed through the hosting provider’s pipeline rather than by hand.
• Every third-party call requests the minimum permission scope the feature needs, and granted scopes are checked before a feature runs.
• Input from users and from third-party APIs is validated. Errors are logged without secrets or personal data.
• Dependencies are pinned and updated regularly; security advisories for direct dependencies are reviewed monthly.
• Security headers (content-type sniffing protection, frame denial, referrer policy, HSTS) are set on public sites.

10. Third-party APIs and data

Data from TikTok Shop is accessed only through the official Affiliate Creator API, only after the creator authorizes our app, and only for the purposes described in our privacy and data protection policy. We store only what the studio displays, we never resell or redistribute it, and we delete it on revocation. We comply with the TikTok Shop Partner Center terms and developer data policies, and we will accommodate any audit or data request TikTok makes under those terms.

11. Logging and monitoring

• Application and request logs are retained by the hosting provider for up to 30 days and reviewed when something fails.
• A health check covering the database, every third-party integration, and the TikTok Shop connection runs on demand and after every deployment.
• Scheduled jobs report failures to the operations team through the internal alert channel so a broken integration cannot go unnoticed.
• Logs never contain access tokens, secrets, or creator conversations.

12. Vulnerability and threat management

• Threat sources we track: dependency advisories for our code, provider security bulletins, TikTok Shop developer notices, and reports sent to us directly. The security lead reviews these monthly and after any relevant public disclosure.
• Platform patching (operating system, runtime, database engine) is handled by our managed providers.
• Critical vulnerabilities in our own code or direct dependencies are fixed and deployed within 72 hours of becoming known; high within 14 days; others in the normal release cycle.
• Anyone can report a security issue to hello@momfinds.co. We acknowledge within 3 business days and do not pursue good-faith researchers.

13. Incident response

Roles: the security lead directs the response and owns all external communication; the operations team handles containment and recovery. Reporting channel: anyone who suspects an incident, inside or outside the studio, emails hello@momfinds.co and, for personnel, also posts in the internal incident channel. Suspected incidents are treated as real until shown otherwise.

1. Detect and record: note what was observed, when, and by whom.
2. Contain: revoke or rotate any credential that may be involved, including TikTok Shop tokens and app secrets, and disable the affected component if needed.
3. Assess: determine what data was affected and whose.
4. Notify: inform affected creators, and TikTok and any regulator where required, without undue delay and no later than 72 hours after confirming a breach of personal data.
5. Recover: restore from backup if needed, verify with the health check, and re-authorize integrations.
6. Learn: write down the cause and the change that prevents a repeat, and update this policy if it fell short.

14. Backup and continuity

• The database provider keeps continuous backups with point-in-time recovery; we can restore to any point in the retention window.
• Application code is in source control and can be redeployed to a fresh environment from the repository plus the environment configuration.
• Public creator data can be re-fetched from public sources; TikTok Shop data can be re-synced after re-authorization. Loss of our database therefore does not lose anything a creator cannot recover.

15. Vendors

We use a limited, vetted set of providers and review each one’s security posture and terms before use and at the annual review. Current providers and what each receives are listed in section 5 of the privacy and data protection policy. We do not add a provider that would receive confidential or private data without updating that list first.

16. Endpoint security and daily baseline

Every device used to access EBC Studio systems must meet this baseline. The security lead checks it at the annual review and whenever a device is added.

• Anti-malware. Built-in, always-on malware protection is enabled and kept current on every company device (on macOS: XProtect, Gatekeeper, and Notarization checks; on any other platform, the vendor’s equivalent or a reputable third-party product). Unsigned or unknown software is not installed.
• Encryption and updates. Full-disk encryption is on. Operating system and browser automatic updates are on, and devices run a currently supported OS version.
• Screen lock. Devices lock automatically after five minutes of inactivity and require a password, passcode, or biometric to resume.
• Passwords and MFA. Every account uses a unique password of at least 16 characters generated and stored in a password manager. Multi-factor authentication is on for every provider and for the password manager itself. Passwords are never reused or shared.
• Clear desk and clear screen. Creator data is not printed. Screens showing creator data are not left unattended or visible to others, and are locked when the user steps away. No creator data is stored on removable media.
• Credentials on devices. Provider credentials live only in the password manager or the provider’s own CLI keychain, never in plain files, notes, or chat.
• Lost or compromised device. Report immediately to the security lead, who rotates every credential the device could reach and revokes its sessions.
• Data use. Personnel do not share creator data outside the studio and do not use it for any purpose other than operating the software.

17. Review

The security lead reviews this policy at least once a year, after any security incident, and whenever we add a system that holds confidential or private data. Changes are recorded by version and effective date at the top of this page.

DB3 LLC, doing business as EBC Studio
United States
hello@momfinds.co