Compliance
How Does Social9 Meet Regulatory Requirements?
Social9 publishes to the social accounts you connect, so we take data protection seriously. Here is how we support GDPR and CCPA, and what you can ask us for.
Frameworks
Regulations and frameworks
What we do for data protection law, and the security frameworks our controls are designed around.
GDPR
Social9 gives business customers what they need to use it under the EU General Data Protection Regulation (GDPR).
- Data Processing Addendum (GDPR Article 28) for every business customer
- Public sub-processor list, with notice before new ones are added
- Right to access, correct and delete personal data
- Download your data from Account Settings
- Delete your account and its data from Account Settings
CCPA / CPRA
California residents can see, delete and control the personal information Social9 holds about them.
- Right to know what personal information is collected
- Right to delete personal information on request
- We do not sell personal information
- Right to non-discrimination for exercising privacy rights
Security frameworks
Our security controls are designed around the AICPA Trust Services Criteria (used by SOC 2), ISO/IEC 27001 and the OWASP Top 10. Social9 does not hold a SOC 2 report or ISO 27001 certificate.
- Social accounts connect through official OAuth; tokens encrypted with AES-256
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Daily encrypted backups, stored separately from production
- Every code change reviewed by a second engineer
- Affected customers told within 48 hours of a confirmed breach
Vendors and people
The people and services that touch customer data are vetted and bound by written terms.
- Security and privacy review before we use a vendor that processes customer data
- Data protection terms that meet GDPR Article 28 with every such vendor
- Confidentiality agreements and yearly security training for staff
Your rights
Your Data Rights
Regardless of where you are located, Social9 respects your rights over your personal data. Here are the rights you can exercise at any time.
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Correct any inaccurate or incomplete personal data.
Right to Erasure
Request permanent deletion of your personal data.
Right to Portability
Export your data in a machine-readable format.
Right to Restriction
Limit how we process your personal data.
Right to Objection
Object to processing based on legitimate interest.
Sub-Processor List
We maintain a transparent list of all third-party sub-processors that handle personal data on our behalf. Enterprise customers can request the full sub-processor list and receive notifications of any changes.
View sub-processorsData Processing Agreement
Our Data Processing Addendum meets GDPR Article 28 and includes the Standard Contractual Clauses. It applies to every business customer automatically, with no signature needed.
Read the DPAHave Compliance Questions?
Ask us about our DPA, sub-processors or data protection practices through the support chat.