Social media management security at SocialPatra
Social media management security is how a scheduling tool protects the accounts you connect, the content you write and the people on your team, and this page explains what SocialPatra does.
SocialPatra holds access to your social accounts, so we treat that access as the most sensitive thing we store. This page lists the protections in place today, in plain words.
We do not hold a SOC 2 or ISO 27001 certification, and no system is perfectly secure. We only describe what we have actually built.
Social media management security: what we do
| Area | What we do |
|---|---|
| Connected account tokens | The access tokens for your connected social accounts are encrypted at rest with AES-256-GCM. Disconnecting an account deletes its stored tokens. |
| Passwords | Passwords are stored only as bcrypt hashes. We cannot read your password. |
| Sessions | You stay signed in with cookies that page scripts cannot read. Refresh tokens are stored as hashes. |
| Workspace separation | Each workspace is kept apart from every other workspace, and the server checks your role and permissions on every request. |
| Roles | Team members are given a role: owner, admin, member, viewer or approver. Each role can do only what it needs to. |
| API keys | API keys are stored only as hashes, so the full key is shown once when you create it. Each key has scopes, can be set to expire, and cannot be given more access than the person creating it has. |
| AI assistants (MCP) | An AI assistant can connect only after you approve it on a consent screen. It receives only the permissions you approve, and anything outside them is refused. |
| Email verification | Features that act on your behalf require a verified email address. |
| Incoming messages | Notifications that social networks and our payment provider send us are checked against their signatures before we act on them. |
| Secrets and transport | Traffic is encrypted with TLS. Our own secrets live in a dedicated secret manager, not in source code, and production systems are reached only through restricted access. |
Your data and your choices
- You can edit and delete posts and media, disconnect any social account, and delete a workspace or your whole account.
- Deleting your account asks for your current password, so someone using an unlocked laptop cannot do it quietly.
- Deleting a workspace removes its data from our database. Copies in our database provider’s backups can remain until they expire on that provider’s schedule.
- There is no self-service full-data download yet. Email us and we will send your workspace data in a common format.
- We do not sell your data, use it for advertising, or share one customer’s platform data with another.
Where your data is hosted
Our application servers and file storage run on Amazon Web Services in the United States. Our Data Processing Addendum lists every subprocessor, and we give workspace owners at least 30 days’ notice before adding one. If a personal data breach affects your data, we email the workspace owner within 72 hours of becoming aware of it.
How to report a security issue
If you think you have found a security problem, email support@socialpatra.com or use the support page, and say it is a security report. Please do not post details in public until we have had a chance to fix it.
Frequently asked questions
Is SocialPatra secure?
We protect accounts and data with encrypted account tokens, hashed passwords, separate workspaces and role-based access. We hold no formal security certification, and the list above is everything we claim.
Does SocialPatra store my social media passwords?
No. You connect an account through the social network’s own sign-in, and we keep only the access token it gives us, encrypted. Disconnecting the account deletes that token.
Can my team members see everything?
No. Each person has a role in the workspace, and the server checks that role on every request. A viewer, for example, has fewer permissions than an admin.
Can I delete my account and data?
Yes. You can delete a workspace or your whole account, and doing so removes the data from our database. Backups held by our database provider can remain until they expire.
Can I limit what an API key or AI assistant can do?
Yes. API keys carry scopes and can expire, and an AI assistant gets only the permissions you approve on its consent screen.
Try it on your own accounts
No card needed to start.