Security at PulsePost
You trust us with access to your social accounts. We take that seriously. Here's how we protect you.
Official APIs only
We connect to social platforms through their official APIs. We never ask for your Instagram password. Connected access tokens are encrypted at rest. Disconnecting removes the token stored by PulsePost; you can also remove PulsePost's authorization from your Instagram account settings.
Encrypted credentials
Passwords are hashed with bcrypt. API tokens are encrypted at rest. We follow industry-standard practices for secret management and never log sensitive values.
Approve-before-post
Nothing publishes without your explicit approval. This isn't just a feature — it's a security control. Even if something went wrong on our end, your content can't go live without you saying so.
Rate limiting & abuse prevention
API requests are rate-limited to prevent abuse. Failed login attempts trigger lockouts. We monitor for anomalous activity.
Data minimization
We collect only what's needed to operate the service. We don't sell data, don't use advertising trackers, and don't share your information with third parties except as required to provide the service (e.g., Stripe for payments).
Compliance
Our practices are designed with GDPR and CCPA principles in mind: data portability, deletion on request, and transparent processing. See our Privacy Policy for details.
Report a vulnerability
If you've found a security issue, please report it responsibly via our contact page. We will acknowledge receipt promptly and work to resolve verified issues quickly.