Data security

Credentials

No social media password ever enters this system. Every connection is made through the platform's own OAuth screen; we receive a token, never a credential.

Tokens are encrypted at rest with AES-256-GCM using per-record data keys, wrapped by a master key that is not stored in the database.

Access

API keys are stored only as SHA-256 digests. A key is displayed once, at creation. Revoking a key takes effect immediately.

Every query is scoped to your workspace at the database level, so one customer's request cannot read another's rows.

Transport and integrity

All traffic is HTTPS. Incoming platform webhooks are verified against their HMAC signature before they are processed; an unsigned or wrongly signed request is rejected.

The publishing queue locks in the database rather than in memory, so the same post cannot be published twice even if more than one server is running.

Reporting a problem

If you believe you have found a security issue, write to 1burakbabacan@gmail.com. Please give us a reasonable window to fix it before disclosing it publicly.