Information security policy
CodeStrato is a trading name of Vibes Gym Ltd, a company registered in England and Wales (company number 10505142), registered office Unit 5d St. Francis Way, Shefford, England, SG17 5DZ. This policy sets out how CodeStrato protects the data handled by LiveLot and by the machines and accounts used to build it. It covers CodeStrato's development computers, its developer accounts (TikTok Shop Partner Center, Shopify, GitHub, Google Workspace, Hostinger) and the LiveLot desktop app. Christopher Kirkby is responsible for security and for keeping this policy up to date.
1. Data classification
| Class | Examples | Rules |
|---|---|---|
| Restricted | App secrets, access and refresh tokens, passwords, buyer personal data | Encrypted at rest. Never written to logs, emails, chat or source code. Buyer personal data is not stored at all. |
| Confidential | Seller stock, costs, sales, orders and fees; LiveLot source code | Kept on the seller's computer or CodeStrato's encrypted machines and private repositories. Shared with no one. |
| Public | Website content, published policies | No restrictions. |
2. Encryption
- In transit: all traffic between LiveLot and TikTok Shop or Shopify uses HTTPS (TLS 1.2 or higher). codestrato.com is served only over HTTPS.
- At rest in LiveLot: app secrets and access tokens are encrypted with the operating system keychain (macOS Keychain, Windows Data Protection API) before they are saved. Seller data stays on the seller's computer; LiveLot asks sellers to turn on FileVault or BitLocker.
- At rest on CodeStrato machines: full disk encryption (FileVault) is turned on for every computer used for CodeStrato work.
3. Access control
- Least privilege: LiveLot requests only the TikTok Shop scopes it uses (orders, finance, products, live data). Unused scopes are removed.
- Seller data is only accessible to the seller on their own computer. CodeStrato has no server copy and no remote access, so no CodeStrato person can view it.
- Developer accounts are used only by Christopher Kirkby, with unique passwords from a password manager and two factor authentication turned on.
- Server access uses SSH keys only. Keys are not shared or copied between people, and are removed when no longer needed.
- Access is reviewed every 6 months and whenever a person or device stops working on CodeStrato.
4. Endpoint baseline
Every computer used for CodeStrato work must have:
- Screen lock after 5 minutes idle, with a password required to unlock.
- Full disk encryption turned on.
- Automatic operating system and security updates turned on.
- Malware protection running: macOS XProtect and Gatekeeper, or Microsoft Defender on Windows.
- The built in firewall turned on, with no inbound services exposed to the internet.
5. Network protection
- LiveLot runs no CodeStrato server that holds seller data, so there is no central database to attack.
- Development machines sit behind a router firewall on a WPA2 or WPA3 network, separate from guest WiFi.
- The public website is hosted separately on Hostinger and holds no LiveLot data. Hosting access is by SSH key only.
- Hostinger and router logs are checked after any suspected incident.
6. Secure development and vulnerability management
- The LiveLot app window is sandboxed with context isolation, has no Node.js access, allows only a fixed list of actions, and runs under a strict content security policy.
- Every release runs the automated test suite, including tests that secrets are encrypted and never sent to the screen.
- Dependencies are checked with npm audit before each release. High or critical issues are fixed before release.
- Electron security updates are applied within 14 days of release.
- Anyone can report a security issue to hello@codestrato.com. Reports get a reply within 2 working days.
7. Incident response
Roles: Christopher Kirkby leads the response, makes the decisions and handles all notifications.
- Detect and record: log what happened, when, and what data may be affected.
- Contain: revoke and rotate affected app secrets and tokens in TikTok Shop Partner Center and Shopify, and change affected passwords and keys.
- Notify: tell TikTok Shop within 24 hours of confirming an incident that affects TikTok Shop data, tell affected sellers within 72 hours, and report to the Information Commissioner's Office within 72 hours when UK GDPR requires.
- Fix: release a fix and help sellers update.
- Review: write up the cause and update this policy.
8. Data protection
CodeStrato follows UK GDPR and the Data Protection Act 2018. How LiveLot handles personal data, including retention, deletion on request and the end of a seller relationship, is in the LiveLot privacy policy. Any data CodeStrato holds for a seller, such as support emails, is deleted within 30 days of the seller asking or of the relationship ending.
9. Review
This policy is reviewed at least once a year, after any security incident, and before any major LiveLot change such as moving data to a server.