1. Scope
This policy applies to Facillitou (legal name: FACILLITOU TECNOLOGIA DE SOFTWARE LTDA, CNPJ 68.722.029/0001-10, Brazil) and to Content OS, our content management platform that connects to third-party platforms such as TikTok, TikTok Shop, YouTube and Facebook, including all data received from those platforms. It covers everyone with access to these systems.
We follow the Brazilian General Data Protection Law (LGPD — Law 13.709/2018) and the data protection requirements of the platforms we integrate with.
2. Roles and responsibilities
- Security and privacy owner (Data Protection Officer): the company owner is responsible for this policy, for access to production systems and for leading incident response. Contact: contato@facillitou.app.
- Team members: follow this policy, use only the access they were granted and report any suspected incident immediately.
3. Data classification
- Public: information published on our websites.
- Internal: operational data such as content plans, scripts and aggregated metrics.
- Confidential: personal data, account credentials, OAuth access and refresh tokens, API keys and data received from partner platforms (for example TikTok Shop affiliate data). This is the most protected category.
4. Access control and least privilege
- Every access to Content OS requires an individual login. Shared accounts are not allowed.
- Access follows role-based permissions (owner, admin, manager, creator, publisher, analyst, viewer), granted per project and per platform. Each person only sees and acts on what their role requires.
- Permission changes and member removal take effect immediately, and removing a member ends all of their active sessions.
- Access to production infrastructure, databases and secrets is limited to the security owner.
- Sensitive actions (logins, account connections, approvals, publications, permission changes) are recorded in an audit log.
5. Authentication and daily security baseline
- Passwords follow a minimum-strength policy and are stored only as Argon2id hashes. Repeated failed logins are blocked.
- Sessions use secure, httpOnly cookies and can be ended by the user at any time, including all sessions at once.
- Multi-factor authentication is enabled on the accounts that administer our infrastructure, source code and email.
- Company computers lock automatically when idle, require a password, run up-to-date antivirus software (Microsoft Defender) and receive operating system updates.
- Credentials and API keys are kept in the hosting provider's secret configuration, never in source code.
6. Encryption
- All traffic to Content OS uses HTTPS (TLS).
- OAuth access and refresh tokens and other secrets are encrypted at the application level with AES-256-GCM before being stored. They are never written to logs or shown in the user interface.
7. Infrastructure and network
- Content OS runs on a managed cloud provider (Railway). Its backend API runs on the provider's private network and is reachable only through our web application, which forwards authenticated requests.
- Databases and queues require credentials and encrypted connections. The cloud provider supplies network-level protection and monitoring.
8. Partner and platform data
- We only connect accounts owned or authorized by Facillitou. Account owners authorize access through each platform's official authorization screen and can disconnect at any time.
- Data received from partner platforms is used only for the purposes the account owner authorized (publishing content, reading performance metrics, managing affiliate products). It is never sold, rented or shared with third parties.
- We request only the permissions each feature needs.
9. Data retention and deletion
- Data is kept only while it is needed for the service. When an account is disconnected, its tokens are revoked and deleted.
- At the end of a contractual relationship, or on a valid request, we delete the corresponding data, except where the law requires us to keep it.
- We help partners (including TikTok Shop) and their users to access, correct or delete personal data on request.
10. Vulnerability management
- Third-party dependencies are reviewed and updated regularly and checked with automated vulnerability audits.
- Every change goes through type checking and automated tests, including tests that confirm users cannot access other projects' data, before it is deployed.
- Security fixes are prioritized and deployed as soon as possible.
11. Incident response
- Report: anyone can report a suspected incident to contato@facillitou.app.
- Contain: the security owner revokes affected tokens, disables affected integrations and rotates keys.
- Investigate: scope and cause are established from the audit log and provider logs.
- Notify: affected partners (including TikTok Shop) are notified within 48 hours of confirming an incident involving their data, and the Brazilian data protection authority (ANPD) and affected people are notified as required by the LGPD.
- Recover and learn: the root cause is fixed and this policy is updated if needed.
12. Review
This policy is reviewed at least once a year and whenever our systems or integrations change in a way that affects security or privacy. See also our Privacy Policy.
13. Contact
Security or privacy questions and incident reports: contato@facillitou.app.