How we secure your Shop data.

Scoped access to the minimum endpoints needed to compute profit and return lifecycle. Every scope is read-only except return_refund.write, which lets you approve or reject returns from inside Foregrade instead of switching to Seller Center. We never request write access to inventory, listings, or pricing. When TikTok deprecates a scope, we re-authorize with the replacement and surface the new consent prompt.

• seller.authorization.info — identifies which shop you linked, and the shop cipher every other call needs
• order.read — per-order revenue + fee breakdown used for profit calculation
• product.read — SKU metadata for COGS attribution
• seller.read — shop info + performance scores behind the Health screen
• reverse.read — return tracking + reverse-logistics events for the queue
• return_refund.write — the only write scope: approve or reject returns without leaving Foregrade
• affiliate.read — creator ROI on the Creators screen

You can revoke these at any time from TikTok Seller Center → Apps. Doing so freezes your dashboard at its last sync and stops future imports within seconds.

• In transit: TLS 1.2+ everywhere, HSTS preloaded on foregrade.io. No mixed-content.
• At rest: AES-256-GCM on every row. OAuth access/refresh tokens are encrypted with a key held in hosting-provider env vars, never written to database in plaintext.
• Sessions: iron-session cookies sealed with AEAD, httpOnly, SameSite=lax, 7-day inactivity timeout plus 30-day hard cap.

Every query is scoped by user_id at the database layer. There is no shared-table pattern where a missing clause could leak another seller's rows — every read is pre-filtered, every write is pre-authorized against the session user. A bug that forgot the filter would surface as an empty result set, not cross-tenant exposure.

You can delete your account from Settings → Security. We revoke the TikTok OAuth grant immediately, purge your orders / returns / products / buyers tables within 24 hours, and expunge encrypted backups on a 30-day rolling window. A deletion confirmation email goes out the moment the primary purge completes — not after the backup expiry.

Every service that processes your data on our behalf. No marketing pixels, no analytics sold to third parties, no advertising cookies.

We notify you before adding or changing a subprocessor. New vendors with access to seller data require an SOC 2 Type II or equivalent third-party attestation.