Information Security Policy

Overview

The Peña Home LLC ("we", "us", "our"), operator of the AffiliIQ mobile application, is committed to maintaining the security, confidentiality, integrity, and availability of all data we handle — including user data retrieved from TikTok's APIs and data provided directly by users of the App.

This Information Security Policy describes the practices, controls, and standards we apply to protect our systems and the data entrusted to us. It applies to all personnel, contractors, and systems involved in the operation of AffiliIQ.

Scope

This policy applies to:

• All systems used to develop, operate, and maintain the AffiliIQ application
• All user data collected, processed, or stored by AffiliIQ
• All personnel and contractors with access to AffiliIQ systems or data
• All third-party services and APIs integrated with AffiliIQ

Data Classification

We classify data into the following categories, each with corresponding handling requirements:

Highly Sensitive: TikTok OAuth tokens, API credentials, payment information, and authentication keys. These are encrypted at rest and in transit, stored server-side only, and never exposed to the client application or third parties.

Personal Data: TikTok usernames, profile information, affiliate performance data, financial data, and app settings. Stored encrypted, access-controlled, and handled in accordance with our Privacy Policy.

Operational Data: Anonymised usage analytics and application logs used for debugging and performance monitoring. Cannot be traced back to individual users.

Access Control

We apply the principle of least privilege to all system access:

• Access to production systems and user data is restricted to authorised personnel only
• All team members use unique credentials — shared passwords are prohibited
• Multi-factor authentication (MFA) is required for all systems containing user data
• Access rights are reviewed regularly and revoked immediately upon role change or departure
• Production database access is logged and auditable

User authentication within the App is handled exclusively via TikTok's OAuth 2.0 system. We receive and store access tokens only — we never receive or store user passwords.

Encryption & Transmission Security

In transit: All data transmitted between the AffiliIQ app and our backend servers is encrypted using TLS 1.2 or higher. All API communications with TikTok are proxied through our backend — the client application never communicates directly with TikTok's APIs.

At rest: All user data stored in our databases is encrypted at rest using AES-256 encryption. OAuth tokens and API credentials are encrypted using industry-standard key management practices.

Key management: Encryption keys are managed through our cloud infrastructure provider's key management service. Keys are rotated regularly and access is restricted to authorised systems only.

Infrastructure Security

AffiliIQ's backend infrastructure is hosted on reputable cloud providers with SOC 2 Type II certification. Our infrastructure practices include:

• Regular automated security patching of all server infrastructure
• Network segmentation to isolate production systems from development environments
• Firewall rules restricting inbound traffic to authorised sources only
• Automated monitoring and alerting for unusual access patterns or system anomalies
• Regular backups of all user data with encrypted storage
• Separate development, staging, and production environments

Third Party Vendors

We carefully evaluate all third-party services before integration. Current third-party services used in the operation of AffiliIQ include:

• TikTok API — data source for affiliate performance data, subject to TikTok's own security standards
• Stripe — payment processing, PCI DSS Level 1 certified
• Cloud infrastructure provider — server hosting, SOC 2 Type II certified
• Firebase Cloud Messaging — push notifications (v2, not yet active)

All third-party vendors are contractually prohibited from using AffiliIQ user data for any purpose other than providing their specific service. We do not sell or share user data with third parties for advertising or commercial purposes.

Incident Response

In the event of a security incident or data breach, we follow a structured response process:

• Detection: Automated monitoring alerts are reviewed immediately upon trigger
• Containment: Affected systems are isolated to prevent further exposure
• Assessment: The scope and impact of the incident is evaluated within 24 hours
• Notification: Affected users are notified within 72 hours of confirmed breach discovery, in accordance with applicable data protection regulations
• Remediation: Root cause is identified and addressed before affected systems are restored
• Review: A post-incident review is conducted to prevent recurrence

To report a security vulnerability or concern, please contact us at cs@affiliiq.com with the subject line "Security Report".

Data Retention & Disposal

We retain user data only for as long as necessary to provide the App's services or as required by law. Upon account deletion:

• Personal data and TikTok performance data are deleted within 30 days
• Backups containing user data are purged within 90 days
• OAuth tokens are revoked immediately upon account deletion or disconnection
• Anonymised, aggregated data may be retained indefinitely as it cannot be traced to individuals

All data disposal follows secure deletion practices to prevent recovery of deleted information.

Compliance & Review

This policy is reviewed and updated at least annually, or following any significant change to our systems, data handling practices, or applicable regulations.

We are committed to compliance with applicable data protection laws including the California Consumer Privacy Act (CCPA) and, where applicable, the General Data Protection Regulation (GDPR).

All personnel with access to user data are required to acknowledge and adhere to this policy. Violations may result in access revocation and appropriate action.

Contact

For questions about this Information Security Policy, to report a security concern, or to exercise your data rights, please contact us: