Security
When you connect your business’s social accounts, you’re trusting us with the ability to post as you. Here’s how we protect that.
Access to your social accounts
- When you connect an account, the platform gives us an access token. It’s stored only on our servers and never sent to your Mac or browser.
- Tokens are encrypted with AES-256-GCM, each one sealed to its own account, so a copied token can’t be used anywhere else.
- They’re decrypted only in memory, only at the moment a post is published, and never written to logs.
- We ask each platform only for the permissions posting needs.
- Disconnect an account and its tokens are deleted immediately.
Signing in
- No passwords: sign in with Apple, Google, or a one-time code sent to your email.
- Codes expire after 10 minutes, are stored only as a hash, and allow a handful of attempts. Repeated requests are blocked.
- Sessions are checked on every request, so signing out takes effect everywhere at once.
- The Mac app signs in through your browser, the way the industry standard for desktop apps recommends, and keeps its session in your Mac’s Keychain.
Your workspace
- Every request is checked against your workspace, so nobody else can see or change your posts, media or connections.
- Media is stored privately and only served back to you. Uploads are checked to be real images or videos.
- Requests that don’t come from Postfig itself are refused.
- Posts are published from our servers, once per account — never twice.
Infrastructure
- Everything runs on Cloudflare, with encryption in transit (HTTPS everywhere) and at rest.
- Secrets live in Cloudflare’s secret store, never in code.
- We keep a record of security-relevant events, like sign-ins and connected accounts, without storing your post content or tokens in it.
- Dependencies are audited for known vulnerabilities before every release.
The Mac app
- The app’s interface runs sandboxed, with no access to your files or system beyond what you choose to upload.
- It can only talk to our servers, and opens other links in your browser.
- It never asks for your camera, microphone or location.
You’re in control
- Disconnect any account in Channels, or remove Postfig from the platform’s own settings.
- Delete your whole account in one step. See deleting your data.
Report a vulnerability
If you think you’ve found a security issue, email security@postfig.app. We’ll acknowledge it within two business days and keep you updated. Please give us a chance to fix it before sharing it publicly.