Information Security Policy

Moore & Taylor LLC · Effective September 20, 2026
Policy owner: Lindsay Taylor, Member · Reviewed annually, or after any security incident

1. Purpose and scope

This policy describes how Moore & Taylor LLC protects information it handles, including data accessed through the TikTok Shop Partner APIs. It applies to both members of the Company and to any future employee or contractor, and to all devices and accounts used for Company work.

The Company operates no servers and no public-facing infrastructure. All Company data resides on encrypted endpoint devices and in the accounts of named service providers.

2. Roles and responsibility

Lindsay Taylor is accountable for information security and privacy at the Company, acts as the Company's appointed data protection contact, and is the escalation point for any security or privacy concern. Contact: mooreandtaylor@gmail.com.

Moore & Taylor LLC is a member-managed Arizona LLC with two members, Lindsay Taylor and Desiree Moore. Both members are authorized to access Company systems. The Company currently has no employees, contractors, or subcontractors.

3. Access control

• Access to Company systems is granted on the principle of least privilege: only to the members of the Company, and only to the systems they need for their work.
• Each member uses their own individual credentials. Logins are not shared between members.
• Multi-factor authentication (MFA) is enabled on all accounts that support it, including Company email, TikTok Shop Partner Center, the domain registrar, and each linked TikTok account.
• Access is reviewed at least once a year and revoked promptly when a person stops working with the Company.
• Sign-in and access logs are retained by the service providers the Company uses, including its email provider, password manager, domain registrar, hosting provider, and TikTok Shop Partner Center. These logs are available to the policy owner, reviewed during the annual access review, and consulted whenever suspicious activity is suspected.
• Before a new member, employee, or contractor is given access, they are set up with their own account, MFA is enabled, and they review this policy.

4. Passwords and credentials

• Passwords are unique per service and are generated and stored in a password manager.
• Password complexity is enforced by the password manager's generator; short or reused passwords are not permitted.
• API keys and secrets are stored in access-restricted files on Company-controlled machines and are never placed in shared documents, public repositories, screenshots, or support tickets.
• Credentials are rotated promptly if there is any reason to believe they have been exposed.

5. Device security

• All Company computers use full-disk encryption (FileVault on macOS).
• Devices lock automatically after 5 minutes of inactivity and require a password or biometric to unlock.
• Operating systems and applications are kept up to date, with automatic security updates enabled.
• Devices are not left unattended and unlocked in public or shared spaces, and work areas are kept clear of written credentials or printed sensitive material.

6. Network and endpoint security

• Company work devices are kept on a dedicated network segment. Personal, household, and internet-of-things devices are placed on a separate guest network and cannot reach Company devices.
• Host-based firewalls are enabled on all Company endpoints, blocking unsolicited inbound connections.
• Anti-malware software is installed and active on all Company computers, alongside the operating system's built-in malware protection, providing host-level detection and prevention of malicious activity.
• Anti-malware runs with real-time protection enabled, performs scheduled scans at least weekly, and updates its threat definitions automatically.
• The Company operates no servers, no internal corporate network, and no publicly reachable services, so there is no external attack surface to expose.
• Company work is not performed over untrusted public wireless networks without an encrypted connection.

7. Data classification

The Company classifies the data it handles into three levels, and handles each accordingly:

• Restricted — API keys, secrets, access tokens, and account credentials. Stored only in a password manager or in access-restricted files on encrypted Company devices. Never shared, transmitted in plain text, or included in screenshots, logs, or support tickets.
• Confidential — affiliate performance data, commission figures, and business records. Stored on encrypted Company devices, accessible only to Company members, transmitted only over TLS 1.2 or above.
• Public — published policies, the Company website, and marketing material. No access restriction.

The Company does not collect or store buyer or consumer personal data of any classification.

8. Data protection in transit and at rest

• In transit. All connections to TikTok Shop APIs, Company email, the Company website, and other services use TLS 1.2 or above. Connections that cannot negotiate TLS 1.2 or higher are not used.
• At rest. Data at rest on Company devices is protected by FileVault full-disk encryption, which uses XTS-AES-128 encryption with a 256-bit key, exceeding the AES-128 minimum.
• Credentials at rest. Restricted data — credentials, API keys, secrets and access tokens — is additionally protected by the end-to-end encryption of the password manager in which it is held, and by the device authentication required to unlock it.
• Backups. Any backup of Company data inherits the same encryption standard as the device or service holding it; unencrypted backups of Company data are not kept.

9. Data minimization and retention

• We request only the minimum API permissions needed for our stated purpose.
• We do not collect buyer or consumer personal data.
• Affiliate performance data is retained for 24 months and then deleted.
• Access tokens are deleted when an authorization is revoked.
• At the end of any contractual relationship, all data collected under that relationship is deleted from Company systems.

10. Vulnerability and threat management

• Operating systems, browsers, and applications on Company devices are patched promptly, with automatic security updates enabled so critical fixes apply without delay.
• The Company monitors security advisories and breach notifications from the vendors it depends on, including its operating system vendor, password manager, email provider, domain registrar, hosting provider, and TikTok Shop Partner Center.
• Where a vulnerability affects a service the Company uses, the Company applies the vendor's remediation, and rotates any credentials that may have been exposed.
• Endpoint vulnerability scanning. The Company's anti-malware software performs vulnerability scans of Company endpoints, identifying missing security updates, out-of-date applications, and weak system settings. Scans run at least monthly and identified issues are remediated promptly.
• Credential exposure monitoring. The Company password manager continuously checks stored credentials against known breach data and flags weak, reused, or compromised passwords. Flagged credentials are changed on discovery.
• Public surface. The Company's only internet-facing asset is a static website with no login, no forms, no user accounts, and no database. It is served over HTTPS with TLS 1.2 or above by its hosting provider, whose platform security and certificate renewal are managed by that provider.
• Penetration testing. The Company operates no servers, applications, or self-hosted infrastructure, so there is no bespoke system to penetration test. Should the Company deploy such a system in future, testing will be introduced before it handles Company or partner data.
• Tracking and records. Identified vulnerabilities, the action taken, and the date of remediation are recorded by the policy owner. Scan results and remediation records are retained and reviewed during the annual policy review.
• Because the Company operates no servers or public-facing services, its vulnerability surface is limited to endpoint devices and third-party SaaS accounts, and management is focused there.
• This process is reviewed at least annually alongside this policy.

11. Vendors and subcontractors

The Company does not currently use subcontractors or third-party data processors for data covered by this policy.

Before engaging any vendor with access to Company data, we confirm they provide appropriate security protections and a data processing agreement where required, and we update this policy.

12. Monitoring

We review account sign-in alerts and security notifications from our email provider, password manager, domain registrar, hosting provider, and TikTok Shop Partner Center, and investigate anything unexpected. Endpoint protection and host firewall alerts on Company devices are reviewed when raised.

13. Incident response

If a security incident is suspected:

1. The person who notices it reports it to Lindsay Taylor immediately. Lindsay Taylor owns the response and all related decisions.
2. Affected credentials are rotated and affected access is revoked.
3. We determine what data was involved and how the incident occurred.
4. We notify affected parties, TikTok Shop, any affected sellers, and relevant authorities as required by law, without undue delay.
5. We document what happened and what we changed to prevent recurrence.

Roles and responsibilities

• Lindsay Taylor, Member (policy owner) — incident owner. Decides on containment, credential rotation, and access revocation; determines what data was involved; owns all external notification to TikTok Shop, affected sellers, affected individuals, and authorities; records the incident and the remediation.
• Desiree Moore, Member — reports any suspected incident immediately to the policy owner, assists with containment, and does not communicate externally about an incident except as directed by the incident owner.

Reporting and communication channels

• Internal reporting: immediately to the policy owner, by any available direct channel, at any hour.
• External reporting to the Company: mooreandtaylor@gmail.com, monitored by the policy owner. Anyone — including partners, sellers, and members of the public — may report a suspected security or privacy concern to this address.
• Outbound notification: TikTok Shop and any affected sellers are notified through the Company's TikTok Shop Partner Center contact channels; affected individuals and authorities are notified as required by law, without undue delay.

Exercises and records

• The Company conducts an incident response exercise at least once a year, walking through a realistic scenario against this procedure to confirm the steps, contacts, and recovery targets still hold.
• A written record of each exercise, and of each real incident, is retained by the policy owner, covering what happened, what was decided, what was notified, and what was changed as a result.
• Findings from exercises are fed into the annual review of this policy.

14. Business continuity and recovery

The Company has assessed the business impact of losing access to each of its key assets, and has set recovery objectives accordingly. Recovery Time Objective (RTO) is the target time to restore access; Recovery Point Objective (RPO) is the maximum acceptable data loss.

• Company email — provider-hosted and replicated. RTO 4 hours, RPO near zero. Recovery is by account recovery with the provider using retained multi-factor authentication methods.
• Password manager vault — end-to-end encrypted and synchronized across Company devices. RTO 4 hours, RPO near zero. Recovery is from a second authenticated Company device.
• TikTok Shop Partner Center and app credentials — RTO 2 business days, RPO zero. Credentials can be regenerated by the policy owner; API authorizations can be re-issued.
• Affiliate performance data — RTO 5 business days, RPO 24 hours. This is reporting data derived from TikTok Shop and can be re-retrieved through the API, so loss is recoverable rather than permanent.
• Company website and published policies — RTO 24 hours, RPO zero. Source files are held on Company devices and can be redeployed to the hosting provider within minutes.
• Linked TikTok creator accounts — RTO dependent on the platform's own account recovery process. Multi-factor authentication is maintained on each account to reduce the likelihood of loss of access.

Because the Company operates no servers and no self-hosted infrastructure, its continuity exposure is limited to account access rather than system failure. No single Company device holds the only copy of any asset required to operate.

15. Training and awareness

Everyone with access to Company systems reviews this policy when they are granted access and at least annually, and is expected to recognize phishing attempts and report anything suspicious.

16. Policy review

This policy is reviewed at least annually and updated when our systems, members, vendors, or obligations change.

Adoption

Adopted by Lindsay Taylor, Member
Moore & Taylor LLC
September 20, 2026