Security
You trust PostClock with accounts that matter. Here is how we look after them.
Your accounts
Official APIs only
PostClock posts through each network's official API. It never scrapes or automates a browser.
No passwords
You sign in on each network's own page and approve PostClock there. PostClock never sees your password.
Encrypted tokens
Access tokens are encrypted with AES-256-GCM before they are stored. Disconnecting an account deletes its token at once.
Clients stay in control
A client invite connects one account, once. The client signs in on their side.
Your data
Private media
Your files sit in a private store. PostClock hands networks short-lived signed links.
Workspace separation
Every read and write is limited to your workspace. Browsers cannot reach the database.
Limited retention
Inbox comments and messages are kept for 180 days after the last activity. Server logs for up to 30 days.
No selling, no training
We do not sell your data, use it for advertising, or train AI models on it.
Your team
Roles
Owners, admins and members each see only what their role allows.
API keys
Keys are stored as hashes. Make them read-only or expiring, and revoke them at any time.
Signed webhooks
Each webhook carries a signature, so you can check it came from PostClock.
Audit trail
Team and settings changes are recorded in an append-only log.
Where data lives
The database, sign-in and files run on Supabase in the United States. The application runs on OVHcloud in Canada. All traffic uses HTTPS. Read the full Privacy Policy or see how to delete your data.
Report a problem
Found a security issue? Email support@postclock.social and we will look into it.