Security
Your accounts stay yours
Protecting your connected accounts
Your social media tokens are the most sensitive thing we hold. They are encrypted, never exposed, and separate from the keys your tools use.
Account tokens are encrypted
The OAuth tokens and credentials for your connected accounts are encrypted at rest with AES-256-GCM. They are never returned by the API, the SDK, the CLI or the MCP server.API keys are stored as hashes
We keep only a SHA-256 hash of each API key. The full key is shown once, when you create it, and can be revoked at any time from the dashboard.Agents never see your tokens
An AI agent gets a Socifyr API key, not your social media logins. Revoke the key and the agent loses access immediately, without touching your connected accounts.Passwords are hashed
Dashboard passwords are hashed with bcrypt. You can also sign in with Google or a magic link and never set a password at all.
Guardrails for AI agents
Give each agent its own API key and set limits on it. Guardrails are enforced by the API, so they apply to MCP, the SDK, the CLI and REST alike.
Daily post limits
Cap how many posts a key can create per day. A runaway loop stops at the limit instead of flooding your accounts.X spend caps
Set a monthly limit on the X (Twitter) API cost a key can run up. Posts past the cap are refused.Human approval
Require approval and every post from that key waits for a person to approve it in the dashboard before it publishes.Deny by default
A key with any guardrail can only change posts it created itself, plus a short list of read and helper routes such as usage, analytics and media uploads. It cannot manage API keys, members, webhooks, connections, approvals or billing, so it cannot lift its own limits.
Platform security
HTTPS everywhere
The dashboard, the API and the MCP server are served over HTTPS only. Session refresh tokens live in httpOnly cookies that page scripts cannot read.Signed webhooks
Every webhook delivery carries an HMAC-SHA256 signature in the X-Webhook-Signature header, so your endpoint can verify it really came from Socifyr.SSRF protection
When you connect a self-hosted service such as a Mastodon instance or a Nostr relay, we only connect to public internet addresses, checked again at connect time, and never follow redirects.Rate limiting
The API is rate limited (only the health check and the payment webhook are exempt), and sign-in, sign-up and password-reset routes allow only a few attempts a minute, to slow down brute-force attacks.Single-use connect links
Connecting an account uses short-lived, single-use codes, so a connect link that leaks cannot be replayed.Role-based access
Team members get one of four roles (Owner, Admin, Editor, Contributor). The API enforces the same permission map the dashboard shows.
Your data
We keep what we need to publish and report on your posts, and clear out old post media on a schedule.
Old post media is cleared
Photos and videos attached to posts that finished publishing (or failed) more than 30 days ago are removed from our storage. Files in your media library that you never posted are kept until you delete them. Your published posts stay on the platforms.History by plan
The Free plan shows the last 30 days of post history; paid plans show your full history.We never see your card
Payments are handled by Polar. Card details go straight to them and never touch Socifyr servers.
Compliance
Socifyr is a young product, and we would rather be clear than impressive.
Report a vulnerability
Found a security issue? Email privacy@socifyr.com with the details and steps to reproduce. Please give us time to fix it before sharing it publicly, and do not access other people’s data while testing. We will confirm receipt and keep you updated.
Hand your agent a key, not your passwords
Connect your accounts once, give each agent its own guarded key, and revoke it whenever you like. The free plan needs no card.