ComboX — Information Security Policy
Last updated: October 13, 2026 · Português abaixo · Operated by PATRIK SANTOS DUTRA DA SILVA LTDA (PRO TOOLS BOX), CNPJ 65.070.538/0001-18 · About · Privacy Policy
1. Scope and responsibility
This policy covers the ComboX web application, its server, database and the TikTok Shop data it processes. The owner/operator of ComboX is responsible for security and data protection and is the incident contact: cjen25362@gmail.com. The policy is reviewed at least once a year and after any incident or significant change.
2. Data classification
| Class | Examples | Handling |
|---|
| Confidential | TikTok Shop access/refresh tokens, API keys, app secret, user sessions | Server-side only; never sent to the browser, logs or source code; encrypted in transit and at rest; deleted on disconnect/revocation. |
| Internal | User e-mail, generated scripts and videos | Accessible only to the account owner; encrypted in transit and at rest; time-limited retention. |
| Public | Public TikTok Shop product information | Used to generate content. |
3. Access control (least privilege)
- Administrative access to the server and database is restricted to the owner.
- Database tables use row-level security; privileged keys exist only in the server environment and are never shipped to the browser or committed to source control.
- Every API route requires an authenticated session; owner-only features check the account on the server.
- The TikTok Shop app requests only the scopes it needs:
creator.video.write, creator.showcase.write, creator.affiliate.info. It does not request buyer or order data.
4. Network protection
- Public traffic reaches the application only through Cloudflare (HTTPS, DDoS protection) and an allow-list proxy that forwards only known routes.
- The server firewall denies all inbound traffic by default; the application port accepts connections only from Cloudflare IP ranges, and internal services listen on localhost only.
- Brute-force protection (fail2ban) blocks repeated failed SSH logins; rate limits protect the API.
5. Encryption
- In transit: HTTPS/TLS between users and Cloudflare, and between the server and the database, TikTok Shop and other providers.
- At rest: the database (Supabase) encrypts stored data with AES-256.
6. Endpoint and operational baseline
- The workstation used to operate ComboX runs Microsoft Defender antivirus with real-time protection.
- The workstation requires a password to unlock after the screen lock.
- Two-factor authentication (2FA) is enabled on the accounts used to operate ComboX (Google, TikTok).
- Unique, strong passwords; secrets are never shared over chat or e-mail and are rotated if exposure is suspected.
7. Vulnerability and patch management
- Automatic security updates are enabled on the server (unattended-upgrades) and pending updates are reviewed and applied regularly.
- Application dependencies are kept up to date and the code goes through security reviews; fixed findings are tracked in the code base.
8. Incident response
- Detect and report: anyone can report an issue to cjen25362@gmail.com; server logs are monitored.
- Contain: revoke/rotate affected keys and tokens, block the source, isolate the affected component.
- Assess: determine which data and users were affected.
- Notify: TikTok Shop and affected sellers/creators are notified within 72 hours of a suspected or confirmed breach involving their data, and the ANPD when required by LGPD.
- Recover and learn: fix the root cause, restore service and record the incident and lessons learned.
9. Data deletion
Data is kept only as long as needed (see the Privacy Policy). On request, on revocation of the TikTok Shop authorization or at the end of the relationship, all related data is deleted.
ComboX — Política de Segurança da Informação
Atualizada em 13 de outubro de 2026 · Política de Privacidade
1. Escopo e responsável
Vale para o app ComboX, o servidor, o banco de dados e os dados do TikTok Shop. O dono do ComboX é o responsável por segurança e proteção de dados e o contato para incidentes: cjen25362@gmail.com. Revisada pelo menos 1 vez por ano.
2. Classificação dos dados
- Confidencial: tokens do TikTok Shop, chaves de API, segredo do app, sessões — só no servidor, nunca no navegador, em logs ou no código; criptografados.
- Interno: e-mail do usuário, roteiros e vídeos — só o dono da conta acessa; retenção limitada.
- Público: informações públicas de produtos do TikTok Shop.
3. Controle de acesso
Acesso administrativo só do dono; segurança por linha no banco; chaves privilegiadas só no servidor; toda rota exige login; o app do TikTok Shop pede só os 3 escopos necessários.
4. Rede
O tráfego público passa só pela Cloudflare (HTTPS) e por um proxy com lista de rotas permitidas. O firewall do servidor bloqueia tudo por padrão e só aceita a porta do app vindo da Cloudflare; serviços internos só em localhost; fail2ban contra tentativas de senha; limite de requisições na API.
5. Criptografia
HTTPS/TLS em trânsito; banco de dados criptografado em repouso (AES-256).
6. Estações e operação
O computador usado para operar o ComboX tem o Microsoft Defender ativo e pede senha ao sair do bloqueio de tela. Verificação em duas etapas nas contas Google e TikTok. Senhas fortes e únicas; segredos nunca enviados por chat ou e-mail e trocados se houver suspeita de exposição.
7. Vulnerabilidades
Atualizações automáticas de segurança no servidor; dependências atualizadas e revisões de segurança do código.
8. Resposta a incidentes
Detectar e reportar → conter (trocar chaves/tokens, bloquear a origem) → avaliar → avisar o TikTok Shop e os usuários afetados em até 72 horas (e a ANPD quando a LGPD exigir) → corrigir e registrar.
9. Exclusão
Dados guardados só pelo tempo necessário; apagados a pedido, na revogação da autorização ou no fim da relação.