Security
What protects the accounts you connect.
Connecting a social account hands over the ability to publish as a brand, which makes it one of the more sensitive credentials a company holds. Everything below describes what Crestnote does with it today, in enough detail that somebody could check.
Connected accounts
The access tokens for your Instagram, TikTok and other connections are encrypted with AES-GCM and held in a schema the application role cannot read. They are decrypted on the server, for one call, and never travel to a browser. The parts a screen actually needs, the handle, the scopes and the expiry, sit in ordinary columns so nothing has to be decrypted to draw a page.
One workspace cannot see another
Every table carrying customer data is protected by a row-level policy in the database, keyed to workspace membership. Postgres enforces it underneath the application, so a query written wrongly in a route comes back empty. Cross-tenant foreign keys are composite, which means the database itself rejects a request pointing at another workspace’s folder or asset.
The browser holds no database credentials
There is no client-side database connection in this product at all. Every read runs inside a server component or a route handler that has already resolved who you are and which workspace you are in, and every write goes through a checked server path. A person poking at the JavaScript finds nothing to point at a database, because nothing there points at one.
Errors are redacted before they are stored
Platforms quote access tokens back inside their own error payloads. Every path that records an upstream failure, on either publish route, in the crons, in both OAuth callbacks, passes it through one redactor first. There is exactly one of them in the codebase. Three copies would mean three chances for one to miss a token shape.
Sign-in is checked on the server, on every render
The gate is a server layout that runs beneath every screen in the product. Middleware is a convenience on top of it and never the thing standing in the way. Two Next.js vulnerabilities in sixteen months let a caller skip middleware with a request header, and a layout cannot be skipped by anything a client sends. Removing somebody from a workspace takes effect within ten seconds, which is the longest any screen is served from cache.
Competitor data comes from documented APIs
Rival figures are read through the networks’ own published endpoints, using the connection you authorised, under the rate limits they set. Nothing is scraped, no headless browser is involved, and no credential belonging to somebody else is used. That is a security property as much as a legal one. Scraping infrastructure would be a second system holding your data, and this product does not run one.
Processors
Everyone who touches it, named.
Six companies are involved in running the service. Nobody else is, and your data is never pooled into a benchmark shown to another customer, aggregated or otherwise. The privacy policy says what each one receives.
Not yet
What we do not have.
There is no SOC 2 report, no ISO 27001 certificate, no third-party penetration test and no bug bounty. Those are real things with real costs and none of them has been done, so claiming any of it here would be the first thing on this page that was false.
If your procurement process needs one of them, ask early. It is a question about timing and it has a straight answer, which is better to hear now than three weeks into a questionnaire.
Found something wrong? Report it through the address in the privacy policy. A person reads them.