Information Security Policy
1. Scope
JoyDesigns (65.252.899 JOICE RAMOS) sells 3D-printed products on marketplaces. Its in-house system, ecom3d, built and operated by the company's technical responsible, keeps the catalog, stock and prices in sync with Mercado Livre and TikTok Shop, and is used only for JoyDesigns' own shops. This policy covers JoyDesigns, ecom3d, the computers used to operate it, its source code and all data obtained through marketplace APIs. It is reviewed at least once a year and after any significant change.
2. Network protection
- The application runs on a single dedicated server computer in Brazil; the business owner uses it from a computer on the same private network, through a browser over HTTPS. There is no cloud database or third-party storage.
- Internal services (database, APIs) are not reachable from the network. The host firewall accepts inbound connections only from the private local network.
- Internet access reaches only an allow-list of marketplace webhook and OAuth callback endpoints through an encrypted tunnel; the application screens are not exposed to the internet.
- Webhooks are rate-limited and size-limited; TikTok Shop webhooks are rejected unless their HMAC signature is valid. Errors returned to the internet contain no internal details.
3. Endpoint protection
- Server (Windows): antivirus with real-time protection (Microsoft Defender) and automatic security updates.
- Client (macOS): built-in malware protection (XProtect, Gatekeeper), automatic security updates and firewall on.
- Software dependencies and container images are pinned and kept updated (section 8).
4. Security baseline
- Personal accounts on every computer (password or Windows Hello) with automatic screen lock after at most 5 minutes; screens are locked whenever a computer is unattended.
- Individual application logins; credentials are never shared.
- Multi-factor authentication on every account with access to the system or its data (e-mail, source code hosting, marketplace and partner portals).
- Application passwords stored hashed; login attempts rate-limited.
- Secrets are kept only in local configuration excluded from version control.
- Clean desk: personal data is not printed or written down.
5. Access control
- Least privilege: access to personal data only for people who need it to fulfil JoyDesigns' orders (currently two authorized users: the business owner and the technical responsible).
- Role-based access in the application; new users receive the lowest role needed.
- Only the marketplace API scopes the integration needs are requested.
- Quarterly access review; access is revoked as soon as it is no longer needed.
6. Data classification and encryption
- Data is classified as Secret (credentials, tokens), Personal (buyer data), Confidential (prices, sales) or Public (published listings).
- At rest: full-disk encryption (BitLocker on the server, FileVault on the client); marketplace tokens additionally encrypted at field level with authenticated encryption (libsodium XSalsa20-Poly1305).
- In transit: TLS for all traffic, including the local network.
- Logs do not contain secrets, tokens or personal data from database queries.
7. Incident response
- Incident owner: the technical responsible and Data Protection Officer, who informs the business owner of every incident; the business owner approves notifications. Incidents can be reported to joydesigns3d@gmail.com.
- Procedure: record, contain (cut internet access, revoke and rotate tokens and secrets), eradicate, recover, review.
- Notification: TikTok Shop and affected sellers within 24 hours of confirming an incident involving their data; the Brazilian data protection authority (ANPD) and data subjects when required by the LGPD, within 3 working days.
8. Vulnerability management
- Weekly automated dependency scanning and audits before each release; antivirus and OS updates on the host.
- Findings rated by severity; critical fixed within 7 days, high within 30 days, others in the next regular update, with mitigation when no fix exists.
- Automated test suite run after every update before deployment.