AtlasCore Market

TikTok Shop Legal addendum · Legal version v1 · Last updated: July 13, 2026

TikTok Shop API Compliance

Last updated: August 24, 2026

This addendum summarizes AtlasCore alignment with TikTok Shop Partner Center Developer Policy and Data Security & Privacy Requirements (DSPR) for connected TikTok seller accounts.

Independent application status

AtlasCore is an independent software application. TikTok and related marks are trademarks of TikTok Inc. AtlasCore is not sponsored, endorsed, or affiliated with TikTok.

Authorized API use

AtlasCore accesses TikTok Shop Open API endpoints only after explicit seller OAuth consent. Scopes requested are limited to operational features enabled in the connected dashboard (catalog, orders, and fulfillment where authorized).

Write APIs used for seller operations:

- Inventory PUT after confirmed/paid placement (`AWAITING_SHIPMENT`), once per order SKU. The durable inventory marker is committed after a confirmed successful PUT.

  • Package / tracking writes to create or update fulfillment packages for the seller’s TikTok orders.

Data handling controls

- Token encryption: OAuth access and refresh tokens are encrypted at rest (AES-256-GCM) using the `enc:v1:` format.

  • Transport security: Production traffic uses TLS 1.2+.
  • B2C scoping with workspace overlays: TikTok data is scoped to the signed-in seller (`user_id`). Optional `X-Tenant` further partitions rows when a workspace is bound.
  • Webhooks: Incoming TikTok Shop notifications at `POST /api/v1/tiktok/webhooks` are verified with HMAC-SHA256. Operational topics require a declared `tts_notification_id`. The ledger stores an allowlisted operational dictionary, not unrestricted raw payloads.
  • Seller deauthorization: TikTok seller deauthorization / authorization revocation webhooks revoke stored tokens and purge seller-scoped (and workspace-scoped) channel data.
  • Order PII: Buyer and shipping fields default to masked responses. Authorized `include_pii=true` returns only recipient name, phone, and shipping address lines.
  • Retention: Terminal orders (`DELIVERED`, `COMPLETED`, `CANCELLED`) follow a 30-day post-delivery clock (`fulfilled_at` upgrades from shipment to delivery time when delivered). Open orders (`IN_TRANSIT`, `AWAITING_SHIPMENT`, `AWAITING_COLLECTION`, `SHIPPED`) and cancelled orders with no `fulfilled_at` follow a 90-day creation ceiling. See TikTok Shop DPP Compliance.

Seller controls

- Disconnect TikTok Shop in AtlasCore to stop sync and purge stored credentials for the active seller and workspace overlay.

See our Privacy Policy and Disconnect Marketplace guide.