How credentials and advertiser access are actually protected.
Security here means restricted access, server-side secrets, encrypted transport, organization-level separation, and a clear disconnection path. This page describes current production practice and does not claim certifications we do not hold.
Secrets stay on the server
Application secrets live in server environment variables. They are not included in public HTML, JavaScript bundles, screenshots, or client-side storage.
Encrypted in transit
Public access and OAuth callbacks use HTTPS. Internal credentials and tokens are never intentionally sent over an unencrypted public connection.
Who can reach production
Administrative access is limited to personnel who need it for engineering, security, support, or legal compliance.
Only the granted scopes
The application acts only within the permissions approved for the app and granted by the user. Features outside those permissions stay unavailable.
What the logs keep
Security and diagnostic logs record timestamps, request status, and technical identifiers, and are designed to avoid storing secrets or full access tokens.
Cutting access off
Users can request deletion and revoke TikTok authorization. Stored credentials are removed or invalidated wherever technically possible.
Production controls
- Environment-based secret management.
- HTTPS and modern TLS through the public reverse proxy.
- HTTP security headers and a restrictive server configuration.
- Input validation and rate limiting on callback and application endpoints.
- Separation between public website files and private application secrets.
- Database access controls and encrypted storage for retained authorization credentials.
- Backup and recovery procedures appropriate to the production environment.
- Periodic review of dependencies and access permissions.
Report a security issue
Send a detailed report with the subject Security Report. Include the affected URL, a clear description, steps to reproduce, and any relevant timestamps.
Please do not send passwords, access tokens, or unnecessary personal data in the report itself.
Limitations
No system can guarantee absolute security. Ankh Corp Ads Manager does not currently claim SOC 2, ISO 27001, PCI DSS, or any other third-party security certification. Any future certification will be listed here only after it has been formally obtained.