This standard establishes the minimum administrative, technical, and physical safeguards for personal information processed by SellRDepot. It applies to workers, contractors, systems, endpoints, integrations, and service providers that can access SellRDepot information.
1. Governance and accountability
SellRDepot Management owns this standard and designates a Privacy and Security Lead to maintain the data inventory, approve privileged access, coordinate incidents, and review controls. The standard is reviewed at least annually and after a material service, legal, vendor, or incident change. Exceptions must be documented with an owner, reason, compensating control, and expiry date.
2. Data classification and minimization
- Public: approved website and marketing material.
- Internal: routine procedures and non-public business records.
- Confidential: seller account, product, inventory, commercial, employee, and support information.
- Restricted: marketplace credentials and tokens, buyer identity and address, authentication data, order-linked evidence, security logs, and secrets.
Confidential and Restricted information may be collected only for a documented business purpose. Access, sharing, download, and retention must be limited to that purpose.
3. Access control
Every user receives an individual account. Access is assigned by role and approved according to job responsibility. Privileged access is limited to designated administrators and reviewed periodically. Shared credentials are prohibited. Strong passwords are required; multi-factor authentication is required for privileged and cloud services where supported. Access is removed promptly when duties change or employment ends. Authentication and material operational actions are logged where supported.
4. Daily operating baseline
Company devices must use automatic screen locking, supported software, security updates, anti-malware protection, encrypted connections, and passwords or device authentication. Workers must keep customer labels and records out of public view, lock screens when unattended, avoid local copies when the system record is available, and securely dispose of printed personal information. Production secrets may not be stored in source code, email, chat, or public files.
5. Network and endpoint protection
Production databases and administrative services must not be exposed directly to the public internet. Host firewalls default to deny unnecessary inbound traffic. Public web traffic passes through an authenticated encrypted edge or reverse proxy. Network, authentication, and abuse signals are monitored; repeated hostile access is blocked. Company Linux endpoints use maintained anti-malware controls and current signature databases. Remote administration uses encrypted SSH with restricted keys and source access where practical.
6. Encryption and secrets
Personal information and credentials must use TLS in transit. Restricted information must be stored on encrypted primary volumes or in an approved encrypted service. Passwords are stored using one-way password hashing. API secrets and OAuth tokens are limited to authorized services and administrators, are never included in public logs, and are rotated after suspected exposure. Backups containing Restricted data must be encrypted and access-controlled.
7. Retention, deletion, and requests
Records follow a documented retention purpose. OAuth credentials are removed when authorization ends. Data is returned or deleted when the service relationship ends, subject to lawful tax, accounting, dispute, fraud-prevention, and marketplace obligations and backup cycles. SellRDepot assists sellers and TikTok Shop with verified access, correction, export, restriction, and deletion requests. Deletion actions and lawful holds are documented.
8. Service providers
Before a provider receives Confidential or Restricted information, SellRDepot reviews the provider's purpose, access, security features, location, and contractual terms. Providers receive only the minimum information needed and must delete or return it when the service ends, subject to law.
9. Incident response and notification
Suspected loss, malware, unauthorized access, credential exposure, or unlawful disclosure must be reported immediately to the Privacy and Security Lead at [email protected]. The response process is: preserve evidence; contain the event; revoke or rotate access; determine affected systems, people, and data; assess legal and contractual notification duties; notify TikTok Shop, affected sellers, individuals, insurers, law enforcement, or regulators as required; remediate; and complete a documented review.
10. Vulnerability and threat management
SellRDepot monitors vendor notices and system logs, applies security updates according to risk, removes unsupported components, scans relevant systems, investigates alerts, and tracks remediation. Critical internet-facing issues receive priority. Changes to authentication, marketplace APIs, access controls, data flows, or public exposure are tested and reviewed before production release when practical.
11. Availability and recovery
Production data is backed up on a defined schedule. Restore procedures are tested periodically. Recovery access is restricted, and backups containing personal information follow the same classification, encryption, retention, and deletion requirements as production data.
12. Awareness and enforcement
Personnel with access to personal information receive security and privacy instructions appropriate to their work. Violations may result in access removal or disciplinary action. Questions and suspected weaknesses must be reported without delay.