Data Security and Protection

My Mika Shop processes store, order and delivery data necessary for its operation.

MIKA applies measures intended to limit unauthorised access, loss, alteration and uses incompatible with the purpose of the service.

This page describes the main measures actually applied. It is neither a certification nor an absolute guarantee of security.

The application runs on Vercel infrastructure.

The primary database and authentication rely on Supabase. The My Mika Shop project is deployed in the AWS eu-west-3 region, in Paris.

Exchanges between the browser, My Mika Shop, TikTok Shop, CJ Dropshipping, Vercel and Supabase use HTTPS/TLS connections.

TikTok Shop tokens and sensitive credentials related to CJ Dropshipping are encrypted at application level with AES-256-GCM before being stored.

The encryption key is kept server-side in secure environment variables and is not exposed to the browser.

Secrets must not be stored in the source code or in project documents.

Access to the application requires authentication.

Data is partitioned at database level so that a user can only access the data of their own workspace.

Internal administrative access is limited to Edwin Audebert according to operational need.

My Mika Shop requests only the TikTok Shop permissions necessary for the functions implemented.

Buyers' data is used for the fulfilment and tracking of orders, not for advertising or resale.

Personal delivery data is deleted or anonymised 90 days after delivery or cancellation.

Raw webhook content containing order data is deleted after 30 days.

Access credentials are deactivated and deleted when a store or supplier is disconnected or deauthorises the application.

Deletion operations produce a technical record that does not contain the deleted personal data.

Any suspected security incident is analysed, contained and documented internally.

Where regulations require it, MIKA informs the controller, TikTok Shop, the CNIL or the persons concerned within the applicable deadlines.

Incidents may be reported to mikaorganisationai@gmail.com.

Security also depends on the user.

The user must protect their password, enable the protections available on their third-party accounts, limit access to their account and promptly report any unusual activity.

No IT service can guarantee the total absence of risk.

MIKA progressively reviews and adapts its security measures according to the evolution of My Mika Shop, the data processed and the requirements of partner platforms.

My Mika Shop currently claims no ISO 27001 or SOC 2 certification, no independent security audit and no penetration test.