Encrypted Credentials
OAuth tokens, bot keys, and WordPress Application Passwords are encrypted at rest using industry-standard cryptography and isolated from public account metadata.
Data & Account Protection
Security built directly into the data model
Post.Social strictly isolates workspace ownership, authentication secrets, draft content, and historical delivery records with rigorous database boundaries rather than relying on obscure URLs.
Strict Project Isolation
Tenant-level ownership and policy enforcement ensure connected channels, drafts, media assets, and delivery logs can never be accessed across unrelated Projects.
Opaque Public Identifiers
External resources use secure, non-sequential ULIDs. Internal auto-increment IDs and database keys are never leaked to prevent enumeration attacks.
Zero Client Secret Leakage
Platform integration keys and provider secrets reside exclusively in backend environment stores—never returned to browser runtimes, client state, or frontend logs.
Auditable History
Delivery records, timestamps, payload snapshots, and credit consumption ledgers are immutably archived for complete operational auditing.
PCI-Compliant Billing
All payment operations are handled directly through Stripe. Post.Social never touches, processes, or stores your credit card numbers.
Responsible Disclosure
Found a security issue?
We take vulnerabilities seriously. Please report any potential security concerns privately with reproducible details so our engineering team can investigate promptly.
Contact security teamTransparent Security Policy
We believe in transparent engineering. Post.Social does not claim unearned compliance certifications, external audit badges, or formal public bug bounty programs that have not been established.
Ready to simplify your publishing workflow?
Start with a 14-day free trial. No credit card required.
Start free trial