Security

Our approach #

Axcoda Guard connects to your TikTok Shop and sends alerts. The safest data is data we never keep, so we start there: the service stores only what an alert needs — order and return IDs, statuses, deadlines, amounts and the first product of an order. Buyer names, addresses, phone numbers, email addresses and chat message texts are removed from incoming TikTok events before those are stored, and from all TikTok data the Guard app saves only an allow-list of fields that excludes them. The full list is in the Privacy Policy.

This page describes the measures we apply. It is not a certification and it does not promise a service level.

Encryption #

• All connections to Axcoda use HTTPS with HSTS. Services connect to databases only over TLS with certificate verification; unencrypted connections are refused.
• TikTok access and refresh tokens are encrypted with AES-256-GCM using envelope encryption; the keys can be rotated without downtime.
• Recipient addresses (Telegram chat IDs, email addresses, browser push subscriptions) and two-factor secrets are encrypted at the application level and masked in logs.
• Browser push messages are end-to-end encrypted: the push services of Google, Mozilla, Apple and Microsoft only see an encrypted payload.
• Backups are encrypted before they leave the server.

TikTok tokens and shop access #

• Tokens are stored in one dedicated integration service. Other parts of Axcoda never see them.
• Axcoda only reads shop data needed for alerts.
• When you revoke access in TikTok or disconnect a shop in Axcoda, the tokens are deleted immediately (unless another of your shops uses the same TikTok authorisation) and the shop’s order and alert data within 24 hours.
• Removing the Guard app from your account does not revoke access to TikTok. To cut Axcoda off from your shop, disconnect the shop or revoke access in Seller Center.

Isolation #

• Every request is checked against the account it belongs to; one customer cannot see another customer’s data.
• Each service has its own database and database role. Internal services cannot be reached from the internet, and outgoing connections go through an allow-list.
• Production data is never copied to development or test environments.

Sign-in and two-factor authentication #

• You sign in with a one-time link sent to your email (valid for 15 minutes); a password is optional and is checked against known leaks.
• Two-factor authentication (TOTP) is mandatory for account owners and for our staff, and available to every team member.
• We email you when your account is accessed from a new device. You can see your active sessions and sign out everywhere.

Staff access #

• Only named staff accounts with mandatory two-factor authentication can open the internal admin panel, and only from allowed networks.
• Viewing sensitive details requires re-entering a second factor and giving a reason. Every staff action is written to an audit log.
• Access of people who leave is revoked within 24 hours.

Logs #

• Sign-ins, security events and staff actions are recorded in audit logs that cannot be changed and that contain no buyer data.
• Audit logs are kept for at least one year and at most two years.

Backups #

Backups are encrypted, stored in the EU and kept for up to 30 days. Deleted accounts and shops are not restored from a backup.

Deleting data #

How and when your data is deleted — after disconnecting a shop, deleting the app or closing the account — is described in the Privacy Policy.

Security programme #

Axcoda is a small company. The owner is personally responsible for security and reviews these measures at least once a year. Anyone who gets access to customer data signs a confidentiality agreement first. We do not hold security certifications such as ISO/IEC 27001 or SOC 2.

Responsible disclosure #

If you believe you have found a security vulnerability in Axcoda, please email [email protected]. Polish or English is fine.

• Tell us what you found and how to reproduce it.
• Give us reasonable time to fix it before you make it public.
• Do not access, change or delete other people’s data, do not degrade the service and do not use social engineering.

We will confirm receipt within 3 working days and keep you informed. We do not run a paid bug bounty. Our contact details are also published in security.txt.