The short answer
Asking someone to connect their Instagram, TikTok and YouTube accounts is asking for a lot of trust, and "we take security seriously" is what everybody writes. So here is the actual mechanism, in enough detail to judge it.
What you actually hand over
You never give us a password. The OAuth flow happens on the platform's own domain — you log in to Instagram on Instagram — and what comes back to us is a token representing a specific, limited set of permissions you approved on that consent screen.
- We can publish content you schedule, and read back the metrics for posts made through us.
- We cannot read your DMs, see your password, or act outside the scopes shown on the consent screen.
- You can revoke access from the platform's own settings at any time. That kills the token immediately, without involving us.
Where the tokens live
Access and refresh tokens are encrypted at rest with AWS KMS, through a field-level converter applied to those columns specifically. They are not stored as readable strings in the database, so a database dump on its own does not yield working credentials — the KMS key is a separate control with its own access policy.
What happens when an AI agent is involved
We expose the product over MCP, so an AI client can draft and propose posts. That widens the blast radius of a mistake, so publishing is gated: the schedule and publish tools refuse on the first call and return a draft plus a preview. They only act when called again with explicit confirmation, and that rule applies to every caller including our own services. More on the design in this post.
What we are not claiming
We hold no SOC 2 report and no ISO certification today. Those audits are in scope as the platform grows, and claiming them before they are done would be worse than not having them. What is described above is the actual mechanism, which you can weigh on its merits.
GDPR data-access and deletion tooling does exist — you can export your data and delete your account, and deletion removes the stored tokens along with it.
Questions people actually ask
Do you store my social media password?
No. Authentication happens on the platform's own site through OAuth. We receive a permission-scoped token, never a password.
How are OAuth tokens stored?
Encrypted at rest with AWS KMS via a field-level converter on the token columns. They are not readable strings in the database, and the KMS key is governed by a separate access policy.
Can I revoke access?
Yes, from the platform's own app settings at any time, which invalidates the token immediately without involving us. You can also disconnect a channel inside the app, and deleting your account removes stored tokens.
Can an AI agent post to my accounts without asking?
No. Scheduling and publishing tools refuse on the first call and return a draft with a preview link. They only publish when explicitly confirmed, and that applies to every caller including our own internal code.
Are you SOC 2 certified?
No. We have not done a SOC 2 or ISO audit and do not claim compliance we have not been assessed for. This post describes the actual mechanism so you can judge it on the merits.