Security & PrivacyPolicy
Access Control Policy
This policy governs who may access the systems and data of Bump The DSL, LLC, the company that builds and operates Relay (“we”), and how that access is granted, reviewed and removed. It applies to every account, system and dataset we control, including Relay and the personal data it receives from Shopify and TikTok Shop.
Summary
Everyone gets the least access needed for their job, on their own account, protected by multi-factor sign-in. Access to personal data is restricted, logged and reviewed, and it is removed the day someone no longer needs it.
Principles
- Least privilege. People and systems receive only the minimum access their role requires.
- Need to know. Personal data is available only to people who need it for a specific task.
- Individual accounts. Every person uses their own account. Logins are never shared.
- Business ownership. Production accounts belong to the business and have a documented recovery path.
Granting and changing access
- Access is requested and approved by the owner, and only the role needed is granted.
- Administrator access is limited to the people who maintain a system.
- Contractors receive time-limited access under confidentiality obligations, and it ends with their engagement.
Access to personal data
- Relay enforces role-based permissions. Only the owner can connect integrations such as TikTok Shop, or change who can do what.
- Direct identifiers (names, email addresses, phone numbers, shipping addresses) and message text are stored encrypted, and are masked wherever the full value is not needed.
- Viewing an order and changing a setting are recorded in an audit log that shows who acted and when.
- Only the person who administers our infrastructure can reach the production database and secrets. No one else has direct database access.
- API access for automated tools uses separate, revocable tokens. These are read-only unless write access is explicitly needed, and they are stored only as one-way hashes.
- Data received from TikTok Shop is not shared with AI assistants unless the owner deliberately switches that option on. It is off by default.
Authentication
Every account uses a unique password from a password manager, plus multi-factor authentication through an authenticator app or passkey. Where a platform provides its own secure sign-in (for example, Shopify staff accounts), we use it.
Reviews
Every quarter the owner reviews who has access to each system, removes access that is no longer needed, and revokes API tokens that are no longer used.
Leavers and role changes
When someone leaves or changes role, their access is removed or reduced the same day. Any secret they could read is rotated, and any API token issued to them is revoked. The changes are recorded.
Review of this policy
This policy is reviewed at least once a year and whenever we add a system, change how we use personal data, or learn something from an incident. The next scheduled review is October 2027. Version 1.0, first published October 23, 2026.
Contact
Questions about this policy can be sent to privacy@bumpthedsl.com.