Security
How Relay handles your data.
Relay connects to third-party platforms only through their official OAuth flows and reads the minimum it needs.
Authentication
Relay never asks for or stores TikTok, Meta or TikTok Shop passwords. Every connection uses the provider's OAuth authorization flow. Brand users sign in with an email link; creators sign in with TikTok Login Kit.
Token storage
Provider access and refresh tokens are encrypted at rest with AES-GCM. The encryption key is held as a Cloudflare Worker secret, separate from the database, and is not accessible to application logs or to other tenants. Tokens are decrypted only in memory at the moment a sync runs.
Scopes requested per provider
| Provider | Scope | Used for |
|---|---|---|
| TikTok Login Kit | user.info.basic | Creator display name and avatar |
| TikTok Shop | Shop, product, order, finance (read) | Attributing sales to creator content |
| TikTok Ads | Ad account, reporting, ad management (read) | Campaign spend and performance |
| Meta | ads_read | Campaign spend and performance |
| Euka (optional) | Brand-issued API key | Creator and content enrichment |
Relay does not request write, publish or messaging scopes. Ad accounts are read-only in the current product.
Disconnect and deauthorization
Any connection can be removed from the Connections page. On disconnect, Relay revokes the token with the provider where the API allows, deletes the stored token immediately, and schedules deletion of the provider's data. Relay also receives and honours deauthorization and data-deletion webhooks from TikTok and Meta, applying the same process automatically.
Retention
Provider data is deleted within 30 days of disconnect, account deletion, or a deletion request to privacy@ugctoads.com. Encrypted backups roll off within the same window. Aggregate usage logs with no provider data may be kept longer for security monitoring.
Infrastructure and subprocessors
Relay runs on Cloudflare (Workers, D1, R2, KV) in the United States. Cloudflare is our only infrastructure subprocessor. All traffic is served over TLS.
Reporting a concern
Email privacy@ugctoads.com. We acknowledge security reports within 2 business days.