Skip to content

Security at SwarmPost

We take the security of your data and social accounts seriously. Here is how we protect you at every layer.

SOC 2 Type II

In Progress

We are actively working toward SOC 2 Type II certification. Contact us for our current security posture documentation.

Data Encryption

Your data is encrypted at every layer, in transit and at rest.

  • ✓AES-256 encryption for all social account tokens stored at rest
  • ✓PBKDF2 password hashing with per-user salt — we never store plaintext passwords
  • ✓TLS 1.3 encryption for all data in transit between your browser and our servers
  • ✓Encrypted database connections with certificate pinning

Infrastructure

Deployed on hardened, globally distributed infrastructure.

  • ✓Vercel edge network — your requests are served from the nearest global PoP
  • ✓Neon PostgreSQL with encryption at rest and automated daily backups
  • ✓Cloudflare DDoS protection and Web Application Firewall (WAF)
  • ✓Zero-trust network architecture with least-privilege service accounts
  • ✓Automated vulnerability scanning and dependency auditing

Authentication & Access

Modern authentication protocols with multiple layers of defense.

  • ✓JWT session tokens with short expiry and automatic rotation
  • ✓OAuth 2.0 with PKCE for all social platform connections — credentials never touch our servers
  • ✓Rate limiting on all API endpoints to prevent brute-force attacks
  • ✓CSRF protection on all state-changing requests
  • ✓Strict Content Security Policy (CSP) headers

Compliance & Privacy

Privacy by design, with tools to help you stay compliant.

  • ✓GDPR-ready with full data export and account deletion on request
  • ✓Privacy by design — we collect only what is necessary to operate the service
  • ✓No sale of personal data to third parties — ever
  • ✓Data processing agreements available for enterprise customers
  • ✓Transparent privacy policy with plain-language explanations

Responsible Disclosure

Found a vulnerability? We appreciate responsible disclosure and will work with you to address it quickly.

  • 1.Email your findings to [email protected]
  • 2.Include a detailed description, steps to reproduce, and potential impact
  • 3.We will acknowledge receipt within 24 hours and provide an initial assessment within 72 hours
  • 4.Please do not publicly disclose the issue until we have had a chance to address it

We do not currently offer a paid bug bounty, but we will publicly credit researchers who report valid vulnerabilities (with permission).

Questions about security?

Reach out to our team and we will provide any additional information your organization needs.

Contact Us