Security

Last updated: 7 October 2026

Unveil handles sellers’ financial data. This page describes the information security programme that applies to Unveil and to all systems that process data from connected stores. It is reviewed at least once a year and whenever our infrastructure changes. How we use personal data is described in our Privacy Policy.

Unveil is operated by Vladimir Novik, trading as Averix. The founder is responsible for security and acts as the owner of every control on this page. Contact: info@averixcorp.com.

1. Principles

Read-only access. Unveil requests read-only permissions and never changes anything in a seller’s store.
Data minimisation. We collect only the data needed to calculate margins and reconcile payouts. We do not request buyer personal data.
No secondary use. Store data is never sold, never combined with other sellers’ data and never used to train machine learning models.

2. Infrastructure and network

Production runs on a dedicated server hosted by Contabo GmbH (Germany), used only for Unveil.
A host firewall allows only HTTPS traffic from Cloudflare and SSH with key-based authentication. Password login is disabled.
The database accepts connections from the local machine only and is not reachable from the internet.
All public traffic passes through Cloudflare, which provides TLS, a web application firewall and DDoS protection.
Development and testing use separate environments and never contain production seller data.

3. Access control

Access to production systems and to personal data is limited to the founder, the single operator of Unveil, on a need-to-know basis.
Services use separate credentials with the minimum permissions they need; the application’s database user cannot alter the schema or access other databases.
All business accounts (hosting, Cloudflare, email, TikTok Shop Partner Center, source code hosting) use unique passwords stored in a password manager and multi-factor authentication.
Access is reviewed whenever infrastructure changes and at least once a year. If people join the team in the future, access will be granted per role and revoked on the day it is no longer needed.

4. Data classification and encryption

We classify data into three levels:

Level	Examples	Handling
Restricted	TikTok Shop access and refresh tokens, API secrets	Encrypted at application level (AES-256-GCM) with a key stored outside the database; never logged
Confidential	Store financial data, product data, account data, uploaded reports	Stored only on the production server; access limited as in section 3
Public	Website content	No restrictions

All data in transit is encrypted with TLS 1.2 or higher.
Database backups are encrypted before they leave the production server and are kept for at most 30 days.
Secrets are provided to the application through environment variables or a secrets store and are never committed to source code.

5. Endpoint security

The company endpoint is a macOS laptop with full-disk encryption (FileVault), built-in malware protection (XProtect, Gatekeeper), a firewall, automatic security updates and automatic screen lock.

6. Vulnerability management

Operating system security updates are installed automatically on the production server.
Application dependencies are checked for known vulnerabilities (cargo audit, npm audit) before each release and at least monthly; critical issues are fixed as a priority.
Public endpoints are protected by Cloudflare’s web application firewall.
Security issues can be reported to the contact above; we acknowledge reports within 3 business days.

7. Incident response

Detect and report. Anyone can report a suspected incident to the contact above. The founder is the incident owner.
Contain. Affected access is revoked, credentials and tokens are rotated and affected systems are isolated.
Assess. We determine what data and which sellers are affected.
Notify. Affected sellers and TikTok Shop are notified without undue delay. Where personal data is involved, the competent supervisory authority is notified within 72 hours of becoming aware of a breach, as required by Art. 33 GDPR.
Recover and review. Systems are restored, the root cause is fixed and the measures on this page are updated where needed.

8. Personal data protection

Personal data is processed in line with the GDPR and our Privacy Policy.
We help sellers and TikTok Shop respond to requests to access, correct, export or delete data within 30 days.
When a seller disconnects their store or deletes their account, all of their store data is deleted within 30 days; encrypted backups expire within the same period.
Service providers process data only under data processing agreements and are listed in our Privacy Policy.