Security Policies

Creators Docket holds a creator's income history and their payout details. This page describes the controls that protect it.

1. Access control

User access

• Tenant isolation. Every record is owned by a user, and every query is constrained by that ownership at the database layer. One account cannot read another's data.
• Password storage. Passwords are hashed with Argon2id. We never store or transmit the password itself, and we cannot recover it.
• Login handling. Sign-in verifies against a hash even when the email address is not registered, so response timing does not reveal whether an account exists.
• Sessions. Session cookies are HttpOnly, Secure and SameSite=Lax. Each session records the originating address and client, so an individual session can be identified and revoked.
• Request forgery. Every state-changing request must carry a custom header that a cross-site form cannot set.

Administrative access

• Least privilege. The application connects to its database as a dedicated account restricted to its own schema. It is not a superuser.
• Named individuals only. Server access is by individual key. There is no shared administrator login, and so no shared credential to rotate when someone leaves.
• Revocation. Removing an individual's key removes their access immediately.

2. Data classification

We hold four classes of data and protect them differently.

In transit: all traffic is served over HTTPS. At rest: the highest class is encrypted at the application layer as described above, and endpoints used to administer the service run full-disk encryption.

3. Information security

• Secrets are never in source control. All credentials live in a root-owned environment file on the server, readable only by the service account.
• Data integrity is enforced by the database, not the interface. The rules that govern money — that delivery must exist before a payment can be recorded, that a record's parts must sum to its total — are database triggers. They hold even if the interface, a script or an automated process is wrong.
• Security headers are set on every response: X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.
• Endpoint baseline. Administrative endpoints run full-disk encryption, vendor malware protection, system integrity protection and automatic operating-system updates.
• Dedicated infrastructure. Creators Docket runs on its own instance. No other product, client website or database shares that machine, so a compromise elsewhere cannot reach this data and a mistake here cannot reach anyone else's.

4. Network security

• Minimal exposure. Only two ports are reachable from the internet: administrative access and HTTPS. Everything else is closed at the cloud firewall.
• The database is not reachable from the internet. It accepts connections only from the application on the same host.
• Segregation. Production is a single dedicated instance with no shared network path to any other system or product.
• Transport. HTTPS is enforced; plain HTTP requests are redirected.

5. Vulnerability management

• Pinned dependencies. Server dependencies install from a lockfile, so what runs in production is exactly what was reviewed.
• Static checks before release. The build fails on a class of error known to compile cleanly and fail at run time. Server-side code is syntax-checked before it is published.
• Release verification. A release is not made live until the build is proven complete. If an expected file is missing, the deployment stops and the previous version keeps serving.
• Reversibility. Every deployment snapshots the previous version first and the last five are retained, so a bad release can be reversed in a single step.
• Patching. Operating-system and dependency updates are reviewed monthly, and security-critical updates are applied on discovery.

6. Incident response

Classification

• Critical — confirmed exposure of personal or financial data; loss of service
• High — unauthorised access, or a vulnerability that could lead to it
• Medium — policy violation or suspicious activity requiring investigation
• Low — minor misconfiguration with no data impact

Process

Contain first, then assess, then remediate, then notify, then record. Affected credentials and tokens are revoked before anything else. Every incident is written up with what happened, what was affected, and what changed as a result.

Notification

• Affected users are notified without undue delay, and in any case within 72 hours of confirming a breach affecting their personal data. We will say what happened, what was affected, and what we are doing about it.
• Platform partners, including TikTok Shop, are notified within 24 hours of confirming an incident affecting data obtained through their systems.
• Reporting channel. support@creatorsdocket.com is monitored for security reports from users, researchers and partners. We acknowledge a report within two business days.

7. Data retention and deletion

Deleting a record in the application removes it from the live database immediately. Copies persist in backups for up to 14 days and then age out. A user may request deletion of their entire account by contacting support@creatorsdocket.com; we action it within 30 days and confirm when it is done.

At the end of a contractual relationship with a platform partner, data obtained through that partner is deleted from live systems and ages out of backups on the schedule above.

8. Subprocessors

We use a small number of providers to operate the service. Each receives only what it needs. The full list, and what reaches each of them, is in the Privacy Policy. We review that list before adding any provider that would handle customer data.

9. Compliance

• All data is stored and processed in the United States.
• We honour access, correction, export and deletion requests from any user regardless of location, as described in the Privacy Policy.
• We assist platform partners in responding to their users' data access, correction and deletion requests.
• We do not sell personal data, share it for advertising, or use customer data to train machine-learning models.

10. Policy maintenance

These policies are reviewed at least annually, and additionally when the infrastructure materially changes, when a new subprocessor is added, or following any incident. The date at the top of this page reflects the last review.

11. Contact

Security reports and general enquiries: support@creatorsdocket.com
Three Days LLC