Security at a glance

Each brand’s data lives in its own workspace, and Postgres row-level security decides which rows every request can see. The rule is enforced by the database itself, not only by application code, so a bug in a page can’t show one brand’s data to another.

We test this on every change: an automated suite signs in as other brands and as creators and checks they get zero rows they shouldn’t. Creators see only their own contracts, videos and payouts, and never a brand’s sales, ad spend or profit.

When you connect TikTok Shop or TikTok Ads, the access tokens TikTok gives us are encrypted with AES-256-GCM before they are stored, bound to the row they belong to, and kept in columns that no user role can read, including owners of the workspace. Only the background sync job decrypts them.

• TikTok Shop: we read affiliate orders, commission, refunds and returns. We never change products, prices, orders or listings.
• TikTok Ads: we read spend and results for Spark Ads and GMV Max, and we add the Spark codes your creators submit to your ad account’s authorized posts. We never create, edit, pause or delete campaigns, ad groups, ads or budgets.

Owners and admins can disconnect either account from Settings → Integrations at any time.

CreatorMecca is passwordless: people sign in with a one-time code sent to their email, so there are no passwords to reuse, phish or leak. Code requests and attempts are rate-limited per email and per IP address.

Access follows least privilege. Workspace roles (owner, admin, ads manager) limit who can approve, pay, invite and change settings. Ads managers work the Spark code queue and don’t approve videos or mark payouts paid. Creators have their own app with no access to brand pages.

Approving a video, completing a contract and creating a payout happen only through checked database functions. Nobody can edit a video’s status or a payout amount directly, including brand admins.

CreatorMecca doesn’t hold or move money. Brands pay creators directly and mark the payout paid; we record who marked it and when.

• Contract documents and signatures are append-only: once written they can’t be changed or deleted. Each signed document is fingerprinted with SHA-256, and the signature records the typed name, email, consent text, time, IP address and browser.
• Changes to a creator’s sign-in email and access are written to an append-only log with who made the change and when, and the old address is told.
• Every uploaded draft version and every piece of review feedback is kept with who added it and when.

• All traffic is served over HTTPS. A strict Content Security Policy and standard security headers apply on every page.
• Uploaded videos are stored in a private bucket and played back through short-lived signed links.
• Product analytics, when enabled, masks page text and never records sessions. We don’t send names, emails or amounts to analytics.
• Error reports are scrubbed of personal data before they leave the app.

CreatorMecca runs on Vercel (application) and Supabase (Postgres database, authentication and storage) in the United States. Email is sent through Resend and subscriptions are billed by Stripe; we never see or store card numbers. The full list is on the Subprocessors page.

We don’t have a SOC 2 report yet. If your team has a security questionnaire, send it to security@creatormecca.com and we’ll answer it. Our Privacy Policy explains what data we hold and why.

If you believe you’ve found a security issue, email security@creatormecca.com with the steps to reproduce it. We reply within one business day and won’t take action against good-faith research that avoids other people’s data and doesn’t disrupt the service.