Security at Konsort Social

Last updated: 11 October 2026. Security contact: Mark Ross, mark@konsortsocial.com.

Konsort Social LLC handles TikTok Shop data on behalf of the brands we work with. This page summarises the controls we maintain. The full policies are available to clients and platform partners on request.

Governance

  • Mark Ross (Founder) owns information security and privacy and is the single point of contact for incidents and data requests.
  • Policies are reviewed at least once a year and after any incident.

Access control

  • Least privilege: staff get access to the client accounts and tools they work on, nothing more. Production infrastructure (database, hosting, API credentials) is administered by one named person.
  • Multi-factor authentication is required on Google Workspace and on every system that supports it.
  • A company password manager is required for all shared and service credentials. Credentials are never shared in chat or email.
  • Access is reviewed quarterly and removed on the day a person leaves.

Data protection

  • Data is classified as Public, Internal, Client Confidential, or Restricted (credentials and access tokens).
  • All data is encrypted in transit with TLS 1.2 or higher. Databases are encrypted at rest by our hosting providers. Restricted data such as TikTok Shop access tokens is additionally encrypted at the application layer with a separate key held only in the hosting environment's secret store.
  • We request only the API scopes a service needs. Our TikTok Shop app does not hold scopes that return buyer personal information.
  • Client data is deleted at the end of an engagement as set out in our Privacy Policy.

Devices and endpoints

  • Every device used for Konsort work must have full-disk encryption, automatic operating system updates, built-in malware protection enabled, a screen lock of 5 minutes or less, and no shared accounts.
  • Client data is accessed through cloud tools, not downloaded to local devices, except where a task requires it and the file is deleted afterwards.

Network and infrastructure

  • Production systems run on Supabase and Vercel, which operate network segregation, intrusion detection and DDoS protection at the platform level. Database access is restricted to the application and to named administrators over encrypted connections.
  • Secrets are stored in the hosting provider's secret manager, never in source code. Source code lives in private repositories with two-factor authentication.

Vulnerability and change management

  • Dependencies are updated monthly and whenever a security advisory affects them. Platform providers patch infrastructure.
  • Changes to production go through version control and are reviewed before deployment.

Incident response

  • Anyone who suspects an incident reports it to mark@konsortsocial.com immediately.
  • The owner assesses within 24 hours, contains the issue, and notifies affected clients and platform partners without undue delay, and within 72 hours where personal data is involved. A written post-incident review follows every incident.
  • No security breach involving personal data has occurred in the last three years.

Business continuity

  • Data is held in managed services with daily backups. Loss of any single laptop does not affect client data.