Security at Social Autopilot

Last updated: September 2026

We design Social Autopilot so that your credentials and published content are protected by default. This page explains, in plain language, how your data is handled.

Connecting social accounts

• You connect each platform on the provider's own authorization page (OAuth). We never ask for or store your social-media passwords.
• Access and refresh tokens are encrypted at rest before they are stored, using a key derived from the server secret.
• Tokens are never returned to the browser and never written to logs.

Your Social Autopilot account

• Passwords are hashed with PBKDF2-HMAC-SHA256 and a per-user salt — the plain password is never stored.
• Sessions are database-backed and delivered over HttpOnly cookies, protected against cross-site request forgery.
• Optional two-factor authentication (TOTP) and a session manager that lets you sign out individual devices.
• Password reset and account emails are sent over TLS; reset links are single-use and time-limited.

Your content

• Only you can see and publish the media you upload; media is served to the authenticated owner.
• Publishing is processed independently per platform, and a failure on one platform never affects the others.

Infrastructure & operations

• Encrypted transport (HTTPS) for all traffic, with strict security headers and a content security policy.
• Managed PostgreSQL database and object storage with encryption at rest and daily backups.
• Error monitoring (Sentry) records crashes without capturing secrets or tokens.
• Optional Redis-based rate limiting protects public endpoints from abuse.

Your rights

You can disconnect any platform, edit or delete your content, and request deletion of your account and data at any time. For a data request, contact the operator of Social Autopilot.

Back to Social Autopilot · Privacy Policy · Terms · Data Processing