Information Security Policy

Version 1.0 · Effective October 22, 2026 · Owner: Eliab de Oliveira Alves (Eagle Digital, CNPJ 24.230.784/0001-02)

This policy describes how Eagle Digital protects the information processed by its store management system (ERP) for retail and fashion merchants, including data received from partner platforms such as TikTok Shop and Mercado Livre with the merchant's authorization.

1. Scope and principles

• Least privilege: we request only the platform permissions needed to register orders, deliver them and reconcile payouts (read access). We do not modify merchant listings or prices unless the merchant asks for it.
• Data minimization: customer personal data is used only to register the order and deliver it.
• No sale or sharing: merchant and customer data is never sold, rented or shared with third parties for advertising.

2. Infrastructure and network

• The application runs on managed cloud providers (Vercel for the web application and Supabase for the PostgreSQL database), which provide network isolation, DDoS mitigation and continuous infrastructure monitoring.
• Production and test environments are fully separated: different projects, different databases and different credentials. Test environments never contain production data.
• The database is accessed only through authenticated APIs; there is no direct public database access for end users.
• All traffic uses HTTPS/TLS encryption.

3. Access control (least privilege)

• Access to personal data is granted on a least-privilege, need-to-know basis and removed when no longer needed.
• Each merchant (store) is an isolated workspace. Row-level security in the database ensures a store can only read and write its own data.
• Every person has an individual login; roles (such as owner, admin and finance) limit what each member can see and do.
• Administrative access to the infrastructure is restricted to the system owner and protected by strong authentication.

4. Data classification and encryption

• Confidential: platform credentials, OAuth tokens and API secrets. Encrypted at rest, server-side only, never displayed after being saved.
• Personal data: customer name, address and phone received with orders. Visible only to members of the store that owns the order; used only for order registration and delivery.
• Internal business data: orders, stock, payouts and financial records of each store. Restricted to that store's members according to their role.
• Public: product catalog the store chooses to publish in its online storefront.
• All data is encrypted in transit (HTTPS/TLS 1.2+) and at rest (AES-256 disk encryption provided by the database and hosting providers).

5. Secrets and credentials

• Platform tokens and API secrets are stored encrypted on the server side (database vault / encrypted environment variables) and are never exposed to the browser or written to source code.
• OAuth access tokens are refreshed as required by each platform and discarded when the merchant revokes the authorization.

6. Secure development

• Every change is developed in a separate branch, tested in an isolated training environment and only then released to production.
• Database changes are versioned migrations, rehearsed before being applied, with a backup of production taken before any structural change.
• Automated tests (application and database) run before each release.
• Incoming webhooks are validated (signature check where the platform provides one) and the full order data is always re-fetched from the platform's authorized API.

7. Logging, monitoring and incident response

• Application and platform logs are monitored for errors and abnormal behavior.

Roles and responsibilities

• Incident owner: Eliab de Oliveira Alves (system owner) — coordinates the response, makes containment decisions and communicates with merchants and partner platforms.
• Store contacts: the owner of each affected store — receives the notification and decides on communication with their own customers, as data controller.

Reporting channels

• Anyone (merchants, partners or researchers) can report a security issue to eaglesmktdigital@gmail.com or WhatsApp +55 62 99228-3600.

Response steps

1. Identify and contain: confirm the incident and immediately revoke or rotate affected credentials and tokens, or disable the affected integration.
2. Assess: determine which stores, data and platforms were affected.
3. Notify: inform affected merchants and partner platforms (such as TikTok Shop) without undue delay and within 72 hours of confirmation, and support merchants in notifying the Brazilian data protection authority (ANPD) when required by LGPD.
4. Recover: restore service from verified code and backups.
5. Learn: record the root cause and corrective actions, and update this policy when needed.

8. Vulnerability and threat management

• Application dependencies are kept up to date and reviewed for known vulnerabilities before each release.
• Database security and performance advisories from the database provider are reviewed and addressed.
• Operating system, runtime and infrastructure patches are applied by the managed cloud providers; development devices receive automatic security updates.
• Reported or discovered vulnerabilities are triaged by severity: critical issues are fixed or mitigated immediately, others in the next release.
• Fixes follow the same secure development flow: branch, test environment, approval, then production.

9. Data retention and deletion

Data is kept while the merchant uses the service and for the period required by Brazilian law for tax and financial records. When a merchant revokes a platform authorization, data received from that platform stops being updated. At the end of the contract, all store and customer data is deleted within 30 days, except records Brazilian law requires us to keep (tax and financial). Data protection officer (DPO): Eliab de Oliveira Alves, eaglesmktdigital@gmail.com.

10. Compliance

Eagle Digital follows the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and the data protection requirements of each partner platform. See also our Privacy Policy.

11. Contact

Security questions or reports: eaglesmktdigital@gmail.com · eliaboliveira07@gmail.com · WhatsApp +55 62 99228-3600.