Security

Data protection

• Access tokens for third-party accounts (Google, Microsoft, TikTok) are stored encrypted with AES-256-GCM.
• Passwords are stored as hashes, never in plain text.
• Connections to the service use HTTPS.

Isolation and access

• Each workspace's data is logically separated; requests are always limited to the user's workspace.
• Role-based access (admin, staff, viewer) with per-feature permissions.
• Agent actions that send or change data can require human approval and are recorded in an activity log.
• Agent access to third-party accounts is limited to the services you select (least privilege).

Webhooks and integrations

• Notifications from platforms (for example TikTok) are verified for signature and freshness before processing.
• Authorisation flows use single-use state parameters to prevent request forgery.

Reporting a vulnerability

If you find a security vulnerability, report it via the Contact page with the subject "Security Report". Please give us reasonable time to fix it before public disclosure.