Information Security Policy

Radiant Peak LLC is committed to protecting the confidentiality, integrity, and availability of information entrusted to us by creators, business partners, and platform providers.

This Information Security Policy establishes the administrative, technical, and operational safeguards used to protect company systems, connected services, credentials, and personal information.

This policy applies to:

• All Radiant Peak LLC personnel and approved contractors
• Company-owned and approved personal devices used to access company systems
• Cloud infrastructure and third-party services used to operate the Radiant Peak platform
• Creator, customer, seller, brand, and partner information processed by Radiant Peak LLC
• TikTok Shop API credentials, tokens, and authorized data

Radiant Peak follows these core security principles:

• Least-privilege access
• Defense in depth
• Secure-by-default configuration
• Encryption of sensitive information
• Data minimization
• Continuous improvement of security controls

Radiant Peak maintains administrative safeguards designed to reduce organizational security risks.

• Security awareness for personnel who handle personal or confidential information
• Documented privacy and data-retention procedures
• Defined responsibilities for system administration
• Periodic review of user permissions
• Prompt removal of unnecessary access when personnel no longer require it
• Review of material system changes before production deployment

Radiant Peak implements technical safeguards designed to protect creator, customer, and business data.

• Encryption of web traffic using HTTPS and TLS
• Encryption of stored application data using managed cloud infrastructure, including Supabase
• Strong password requirements for administrative accounts
• Multi-factor authentication wherever supported
• Role-based access controls following the principle of least privilege
• Secure authentication for connected third-party platforms
• Regular software, dependency, and security updates
• Logging and monitoring of application errors and security events where available
• Protected environment variables or secret-management tools for application credentials

Access to company systems is granted only to authorized personnel whose responsibilities require it.

Radiant Peak will:

• Restrict administrative access to approved personnel
• Use unique credentials for administrative accounts
• Review user permissions periodically
• Remove access promptly when it is no longer required
• Separate elevated administrative access from normal user access
• Prohibit password and credential sharing
• Use role-based permissions where supported

Radiant Peak classifies information according to sensitivity and business impact.

• Public: Information approved for public disclosure, including published website content and policies
• Internal: Routine company information intended for authorized personnel
• Confidential: Creator records, contracts, internal reports, rewards, and operational information
• Restricted: Passwords, App Secrets, access tokens, refresh tokens, authentication data, private keys, and security logs

Confidential and Restricted information must not be publicly shared or stored in unsecured locations.

Radiant Peak protects sensitive information by:

• Encrypting data during transmission using HTTPS and TLS
• Using managed cloud infrastructure that provides encryption at rest
• Limiting access to authorized personnel and services
• Collecting only the personal information reasonably necessary for business operations
• Following documented retention and deletion practices
• Using row-level security and database-access policies where appropriate
• Keeping elevated service credentials out of browser-side and public code

TikTok Shop App Secrets, access tokens, refresh tokens, and other authentication materials are classified as Restricted information.

Radiant Peak will:

• Use credentials only for approved business purposes
• Keep credentials out of public repositories and client-side code
• Transmit tokens only through encrypted connections
• Limit token access to authorized server-side processes
• Revoke or replace credentials when compromise is suspected
• Remove or disable tokens when authorization is revoked or no longer necessary
• Avoid displaying full credentials in logs, screenshots, or user-facing errors

Company devices used to access production systems are expected to maintain reasonable security protections.

• Current operating-system and security updates
• Active anti-malware protection, such as Microsoft Defender or an equivalent service
• Automatic screen locking
• Password or biometric authentication
• Device encryption where supported
• Prompt reporting of lost, stolen, or compromised devices

Radiant Peak relies on reputable cloud and hosting providers that maintain network protection, service isolation, and infrastructure safeguards appropriate to their services.

• Production web traffic will use HTTPS
• Public access to databases and administrative interfaces will be restricted where practical
• Development and production configuration will be separated where appropriate
• Network and infrastructure alerts will be reviewed when available
• Access to cloud dashboards will be restricted to authorized personnel

Radiant Peak uses reasonable secure-development practices when creating and updating the platform.

• Review code before material production changes
• Maintain supported frameworks and dependencies
• Validate and sanitize external input
• Protect OAuth flows using state validation and secure cookies
• Avoid exposing detailed server errors or credentials to end users
• Test authentication and access restrictions
• Use version control and controlled deployment procedures
• Address known high-risk vulnerabilities promptly

Radiant Peak may maintain security and operational logs necessary to detect errors, suspicious activity, failed authentication, misuse, and service interruptions.

• Record authentication, application, and security events where available
• Limit logs to information reasonably necessary
• Restrict access to logs
• Avoid intentionally storing passwords, full access tokens, refresh tokens, App Secrets, or private keys in logs
• Review significant errors and suspicious activity

Radiant Peak continually works to reduce security risks through a vulnerability and threat-management process.

• Apply operating-system and software updates
• Monitor relevant vendor security advisories
• Update application dependencies regularly
• Review system configurations for security improvements
• Prioritize vulnerabilities according to their severity and practical risk
• Correct vulnerabilities that could result in unauthorized access or data disclosure
• Rotate credentials when compromise is suspected

Radiant Peak uses reputable third-party service providers to deliver portions of the platform.

These services may include:

• Cloud hosting
• Database management
• Authentication
• Communications
• Monitoring and diagnostics
• Connected platform integrations

Radiant Peak considers each provider's service purpose, security capabilities, access requirements, privacy terms, and data-processing role before using it for sensitive information.

Radiant Peak maintains procedures for responding to suspected or confirmed information-security incidents.

The response process may include:

• Identifying and documenting the incident
• Containing affected accounts, systems, or credentials
• Assessing the scope and potential impact
• Preserving relevant evidence and logs
• Correcting the underlying vulnerability
• Restoring affected systems safely
• Notifying affected parties, TikTok Shop, sellers, or authorities where legally or contractually required
• Documenting lessons learned and preventive changes

Security concerns and incidents may be reported through contact@radiantpeak.net.

Radiant Peak will maintain practical recovery procedures appropriate to the importance and availability requirements of its systems.

• Database backups
• Configuration and deployment records
• Credential-recovery procedures
• Documented restoration steps
• Recovery testing where practical

Information will be retained only as long as reasonably necessary for the purpose for which it was collected, legitimate business needs, security, dispute resolution, and legal obligations.

When information is no longer required, Radiant Peak will delete, anonymize, revoke, overwrite, or otherwise render it inaccessible using a method appropriate to the sensitivity of the information.

Additional details are available in the Radiant Peak Data Retention Policy.

Violations of this policy may result in removal of access, corrective action, contract termination, or other action appropriate to the circumstances.

This policy will be reviewed periodically and updated as the platform, service providers, legal obligations, security risks, and business practices change.

Security questions, suspected incidents, and responsible vulnerability reports may be sent to:

Do not include passwords, full access tokens, App Secrets, or other sensitive credentials in an initial email.