Security & Data Protection

1Scope and ownership

This policy covers Inbound (the iOS app, its servers and database, and this website) and everyone who works on it for Caravan Transport LLC, a Pennsylvania limited liability company. Today our founder is the only person with access to Inbound’s systems and data.

Our founder owns this policy and is responsible for security and data protection, acting as our data protection officer (privacy@shipinbound.com). We review the policy at least once a year and whenever Inbound’s data flows change. Anyone given access to Inbound systems in the future must follow it.

2Security program

• Least data: only the TikTok Shop Order Information and Shop Authorized Information scopes, read-only, and only the buyer data needed to follow a delivery.
• Least privilege: people and providers get only the access their job needs, and our servers’ privileged database key never leaves the server environment.
• Defense in depth: app users’ requests run under the database’s row-level security with their own sign-in token, so a bug in those paths cannot expose another workspace’s data. Background sync and the TikTok Shop connection run on our servers with the privileged key; that code works out the workspace from our own records (the store a job or signed notification belongs to), and automated tests check that data never crosses workspaces.
• Documented, tested controls: our controls are recorded internally, most with the automated tests that check them.

3Infrastructure and network

• Managed platforms. Supabase runs our database, sign-in and secrets vault; a cloud hosting provider will run our API and worker in a US region; Cloudflare provides DNS, email routing and this static site. We run no data center, office network or servers of our own; these platforms provide the physical and network security.
• Small attack surface. Only this website, our API (api.shipinbound.com) and our database provider’s sign-in and data endpoints face the internet. Direct database connections are limited to our servers’ network addresses and require SSL. Every API data request needs a verified sign-in token; the only public routes are a health check, provider notifications (rejected unless their signature is valid) and the rate-limited TikTok Shop connection callback.
• Internal parts stay internal. App users reach data only through row-level security with their own token; internal tables, queues and functions are closed to them.
• Separate environments. Development uses an isolated local stack with fictional data only.

4Devices and workplace

Every computer used to build or operate Inbound has full-disk encryption (FileVault), the operating system’s built-in malware protection (Apple Gatekeeper and XProtect), automatic security updates, the firewall on, and a screen lock after at most 15 minutes of inactivity. Phones used for sign-in codes or company email must have a passcode with Face ID or Touch ID, auto-lock, a current iOS version and remote erase turned on.

Every administrative account uses multi-factor authentication and a unique random password kept in a password manager: today Cloudflare (DNS, domain, website and email routing), the mailbox our addresses forward to, Apple Developer, TikTok Shop Partner Center and our code host, and from launch our production database and server hosts. Secrets never go into source code, email or chat. We do not print personal data, and we lock screens whenever a computer is left unattended. If a device is lost, we revoke its sessions and keys as soon as we learn of the loss.

5Access control

• Roles. Workspaces have six ranked roles: Owner, Admin, Operations, Support, Analyst and Viewer. Only Owner, Admin, Operations and Support see buyer names and addresses by default. Nobody can change their own role, and apart from owners nobody can grant a role at or above their own.
• Isolation. Every record belongs to one workspace, and the database checks membership and permission on every read and write made with a user’s token (row-level security and per-column rules), verified by automated cross-workspace tests.
• Sign-in. The app offers no password sign-in: Sign in with Apple, or a 6-digit email code that expires in 10 minutes. Access tokens expire after one hour; refresh tokens are single-use.
• Our access. Only our founder has administrative access to production. The app holds only public identifiers. We open seller data directly only for a support or data request or an incident, and log each such access.
• Keys and secrets. The TikTok Shop app secret and our privileged database key are kept only in the server environment, never in source code or the app, and only our founder holds them. We rotate them when exposure is suspected and when anyone with access leaves.
• Audit trail. Changes made through the Inbound API (store connections, disconnects and syncs, exception updates, notes and rules, archiving) and refused attempts at them are recorded (who, what, when, outcome) in an append-only audit log that our servers cannot change or delete.
• Reviews. At least yearly, and whenever a role changes, we review who can reach production systems and administrative accounts, and remove access that is no longer needed.

6Data classification

We never collect buyer phone numbers, buyer emails, TikTok user IDs or unpaid orders.

7Encryption

• In transit: HTTPS only. This website accepts only TLS 1.2 or higher and sends HSTS; our API will be served the same way from launch. The iOS app uses Apple’s App Transport Security with no exceptions and refuses non-HTTPS servers in release builds. Our servers reach TikTok Shop, our tracking provider and our database over HTTPS.
• At rest: our database provider, Supabase, encrypts all stored data with AES-256.
• Access tokens are also encrypted at the application level in Supabase Vault, with libsodium authenticated encryption (XChaCha20-SIV, 256-bit key) under a key Supabase manages outside the database. A copy of the database does not reveal them.
• Hashes: shop connection state values and team invitation tokens are stored only as SHA-256 hashes.

8Secure development and vulnerability management

• Testing: our rule is that every change passes our full automated test suite before it is committed; the suite includes tests for workspace isolation, permissions, signature checks and log redaction.
• Reviews: each development stage ends with a security-focused code review, AI-assisted and run by our founder, and confirmed findings are fixed before release.
• Dependencies: JavaScript dependencies are pinned in a lockfile and checked with npm audit at least monthly and before every release; we follow security advisories for the platforms and libraries we use.
• Fix times: each finding is logged with its severity. Critical: contained within 48 hours, fixed within 7 days. High: 14 days. Medium: 30 days. Low: 90 days. A finding that may have exposed data is handled as an incident.
• Reporting: send security issues to privacy@shipinbound.com. Our Terms forbid testing our systems without written permission.

9Logging and monitoring

• Application logs record each request’s method, path, status, duration and request ID, never query strings, request bodies or notes. Fields carrying tokens, keys, passwords, emails, names, phone numbers, addresses or IP addresses are replaced automatically, and tracking numbers are cut to their last four characters.
• Retention: server logs, including our hosting provider’s request logs, at most 30 days; internal event records 90 days; the audit log permanently, identifying people only by account ID.
• Monitoring: from launch, server errors, downtime and failed daily clean-up jobs alert our founder, who also reviews failed background jobs at least weekly.

10Incident response

Our founder is the incident lead, responsible for every step below and for communication. Report incidents to privacy@shipinbound.com or hello@shipinbound.com; both reach the founder directly.

1. Detect and assess: what happened, how severe, and whether seller or TikTok Shop data is affected.
2. Contain: switch off new shop connections, stop the TikTok Shop connector, rotate the app secret and server keys, end sessions, disconnect affected shops.
3. Eradicate: fix the cause and look for related weaknesses.
4. Recover: restore service and data from backups, then re-read orders from TikTok Shop.
5. Review: a written record of timeline, impact, cause and follow-up actions, kept at least 3 years.

Continuity. Our targets are to restore service within 24 hours (RTO) and to lose at most 24 hours of data (RPO), using our database provider’s daily backups, which are kept no longer than 30 days. Our founder is the single responder, so these are targets rather than guarantees. Order data can also be rebuilt from TikTok Shop: a newly connected shop imports its last 30 days of orders. Source code and configuration (without secrets) are also kept in a private off-site repository with two-factor sign-in.

Exercises. We run a tabletop exercise of this plan at least once a year, the first before launch, and keep a written record of each.

11Breach notification

If we confirm or reasonably suspect a breach affecting seller data or TikTok Shop buyer data, we notify the affected sellers (by email to their workspace owners) and TikTok Shop (through TikTok Shop Partner Center or the contact TikTok designates) without undue delay, and no later than 72 hours after we become aware of it.

The notice says what happened, which data is affected, what we have done and what they should do. We also notify authorities and individuals where the law requires, and keep a record of every notification.

12Retention and deletion

• Buyer names and street addresses: deleted 30 days after the order is completed or cancelled, and never kept more than 120 days after purchase. The destination city, state and country stay with the order.
• Disconnect or deauthorization (in Inbound, in TikTok Shop Seller Center, or a connection broken for 30 days): syncing stops and the shop’s buyer names and addresses are deleted at once, and its access tokens as soon as no other connected shop uses that authorization. Its remaining data, orders included, is deleted 30 days later unless it is reconnected.
• End of the relationship: if a seller leaves, or our TikTok Shop partnership or Inbound ends, we disconnect the affected shops, delete their TikTok Shop data within 30 days and confirm in writing. Backups expire within a further 30 days. The record that a TikTok Shop notification arrived (its event ID and type, without contents) is kept up to 90 days to ignore duplicates. The audit log keeps only IDs, never buyer data.
• Accounts: deleted on request, with their account data deleted immediately.

From launch, deletion runs automatically in a daily clean-up, which is covered by automated tests. Other periods are in our Privacy Policy.

13Requests from sellers and TikTok Shop

• In the app, sellers can disconnect a shop under More ▸ Stores, which starts the deletion above.
• Corrections are made in TikTok Shop and reach Inbound at the next sync: address-update notifications trigger a re-read, and open orders from the last 60 days are re-read about every 6 hours.
• By email, sellers and TikTok Shop can ask privacy@shipinbound.com to delete or provide a copy of data for a shop, order or buyer. We verify the request (a workspace owner or admin writing from their account email, or TikTok Shop through an official channel), act within 30 days and confirm in writing. For an order still open in TikTok Shop, Inbound re-reads it from TikTok, so a lasting deletion may require disconnecting the shop; we tell the seller when this applies.
• Buyers should contact the seller first; we help the seller respond.

14Service providers

Each provider receives only what its job needs. The current list, and what each receives, is in our Privacy Policy; we update it before a new provider receives personal data.

15Contact

Security reports, incidents and data requests: privacy@shipinbound.com. Anything else: hello@shipinbound.com.

16Document control