Information Security Program

1. Program and ownership

Social Generation runs Mixtape, a platform that helps consumer brands turn their footage and performance data into advertising. This program describes how we protect the data brands and platforms entrust to us. The Chief Executive Officer owns the program, approves changes to it, and reviews it at least once a year and after any significant incident or change to our systems.

Everyone with access to Mixtape systems, employees and contractors alike, must follow this program. Their access ends the day their work ends.

2. Infrastructure and network protection

• Hosting. Mixtape runs on managed cloud services in the United States: Supabase (the PostgreSQL database, on AWS in Ohio), Amazon Web Services (file storage in Virginia and the processing server in Ohio), and Cloudflare (the web app, and the secure tunnel to the processing server).
• Segregation. The processing server has no remote-login port open to the internet, and its web ports accept connections only from Cloudflare. Mixtape's processing engine is reached only through a Cloudflare Tunnel that the server opens outward. Internal services (queue and cache) accept connections only from our private network. The database is reached only over encrypted connections, with a separate login for each part of the system.
• Monitoring and prevention. Cloudflare filters web traffic in front of our services, including denial-of-service and web attack protection. Every automated job records each run, and failures alert the team in Slack.

3. Security baseline for daily operations

• Multi-factor authentication is required on every account that reaches company or customer data: Google Workspace, GitHub, AWS, Supabase, Cloudflare and TikTok Shop Partner Center.
• Company computers are Macs that lock the screen after no more than 5 minutes idle, use full-disk encryption, receive operating-system updates, and run the operating system's built-in malware protection.
• Passwords are unique per service and kept in a password manager. Credentials are never shared in chat, email or code.
• Clear desk and clear screen: customer data is not printed, and screens are locked when unattended.

4. Access control and least privilege

• People. Access is granted per role, only as needed, and removed when the role ends. Administrative access to production is limited to named staff.
• Customers. Each brand's data is fenced in the database by row-level security: a signed-in person reads only the brands they belong to. Our own access to a customer's data is limited to supporting that customer.
• Systems. Each part of Mixtape uses its own database login with only the permissions it needs. The web-facing service cannot read stored sign-in keys; it can only call one narrow function to save a connection.
• Credentials. Platform sign-in keys, such as a seller's TikTok Shop refresh token, are encrypted in Supabase Vault. Server secrets are kept in AWS Systems Manager Parameter Store, not in code. Every change to our code is checked automatically for credentials before it is committed.

5. Data classification and encryption

• In transit: every connection uses TLS: browser to app, app to engine, services to the database and storage, and our servers to TikTok and other platforms.
• At rest: the database is encrypted with AES-256 by our provider. File storage uses AES-256 server-side encryption. The processing server's disks are encrypted with AES-256. Sign-in tokens are additionally encrypted in Vault.

6. Incident response and breach notification

Roles

• Incident lead: the Chief Executive Officer. Decides severity, coordinates the response, and owns communication.
• Technical responder: the engineer the incident lead assigns. Contains, investigates and fixes the problem, and preserves evidence.
• Privacy contact and Data Protection Officer: the Chief Executive Officer, at [email protected]. Handles notices to customers, platforms and authorities.

Reporting

Anyone who suspects an incident reports it at once to [email protected] or directly to the Chief Executive Officer. Outside parties can report the same way.

Steps

• Contain: revoke or rotate affected credentials, disconnect affected integrations, and block access.
• Assess: what data was exposed, whose, and for how long.
• Notify: affected customers (sellers) and affected platforms, including TikTok Shop for any incident touching TikTok Shop data, without undue delay and no later than 72 hours after we confirm a breach of their data. Notify authorities where the law requires it.
• Recover and learn: restore service, write a dated record of cause, impact and fixes, and update this program.

7. Vulnerability and threat management

• Every change to Mixtape runs automated checks, including a scan for credentials in code and checks that each system login has only the access its code needs.
• GitHub alerts us to known vulnerabilities in the libraries we use. Dependencies and operating systems are updated at least monthly, and critical security fixes are applied within 7 days of release.
• Credentials are rotated at once if exposed, and on a regular schedule for long-lived keys.
• Database changes are rehearsed against production with automatic rollback before they are applied, and every applied change is recorded.

8. Service providers

We use established providers with their own security programs: Supabase, Amazon Web Services, Cloudflare, Google Workspace, GitHub and Slack. Where a feature uses an AI model provider, we send only the data that feature needs, and never platform sign-in keys.