Security
How Does Social9 Protect Your Data?
Social9 publishes to the social accounts you connect, so we treat those connections as our most sensitive data. Here is what we do to protect them, in plain words. The full detail is in our Information Security Policy.
OAuth only
Social accounts connect through each network's official login. We never see your social passwords.
Encrypted tokens
Access tokens are encrypted with AES-256 before they are stored.
GDPR-ready
A Data Processing Addendum, a public sub-processor list and data deletion on request.
Recognised frameworks
Controls designed around the Trust Services Criteria, ISO/IEC 27001 and the OWASP Top 10. Not a certification.
Every layer
How we protect your accounts and content
A summary of our Information Security Policy, from connected accounts to incident response.
Connected accounts
Connecting a social account lets Social9 publish to it, so we treat those credentials as our most sensitive data.
- Connected through each network's official OAuth flow. We never ask for your social passwords
- Access tokens encrypted with AES-256 before they are stored, with keys kept apart from the database
- Tokens are used only by the publishing service, never sent to the browser or written to logs
- Disconnect an account and its token is revoked where the network supports it, and deleted within 7 days
Encryption
Your content, media and account data are encrypted on the way to us and while we store them.
- HTTPS with TLS 1.2 or higher everywhere, with HSTS
- Customer data, backups and media encrypted at rest with AES-256
- Keys held in a managed key service, with access logged and keys rotated
- Daily encrypted backups, kept 35 days, separate from production
Access and infrastructure
Only the people and services that need your data can reach it, and production is separated from everything else.
- Least-privilege access to production, with single sign-on and MFA for staff
- Staff only look at your content when you ask us to, for example to check a failed post. That access is logged
- Web application firewall with DDoS protection and rate limiting
- Every code change reviewed by a second engineer before release
Monitoring and incidents
Suspicious activity and service errors raise alerts, and a written plan covers what happens if something goes wrong.
- Central logs with automated alerts. Logs never contain passwords or tokens
- Affected customers told within 48 hours of a confirmed breach
- Posts that fail during an outage are retried, and you are told about any that could not go out
- Every significant incident ends with a written review
Responsible Disclosure
We take security vulnerabilities seriously. If you discover a potential security issue, we encourage you to report it responsibly. We acknowledge reports within 2 business days and keep you informed until the issue is resolved.
Read the Full Policies
Our Information Security Policy sets out the controls summarised on this page.
FAQ
Security FAQ
Does Social9 have SOC 2 or ISO 27001 certification?
Not yet. Our controls are designed around the Trust Services Criteria used by SOC 2 and around ISO/IEC 27001, and our Information Security Policy describes them in full.
Can I delete my data from Social9?
Yes. Delete your account from Account Settings, or contact support. Account data is deleted within 30 days, and it leaves our backups as they expire. Our Data Deletion page has the details.
Does Social9 share my data with third parties?
Social9 does not sell your data. We share it only with the service providers we need to run Social9, listed on our Sub-processors page, under data protection terms that meet GDPR Article 28.
Does Social9 see my social media passwords?
No. Accounts connect through each network's official OAuth flow, so Social9 receives an access token, never your password.