Security

Last updated: [DATE]

This page is a template prepared for OmniPost. It has not yet been reviewed by a lawyer, and the bracketed placeholders below (legal entity name, address, jurisdiction, contact emails, dates) are not filled in. It must be reviewed by qualified legal counsel and completed with OmniPost's actual details before being relied on in production.

OmniPost stores OAuth tokens for our customers' connected Instagram, Threads, TikTok, and X accounts, and uses them to call those platforms' APIs. Because that access is sensitive, we design the system around encryption, least privilege, and auditability. This page summarizes our current practices at a high level; it is not an exhaustive security whitepaper.

Encryption

In transit — all traffic to the OmniPost API and dashboard is encrypted with TLS. We do not accept unencrypted HTTP connections in production.
At rest — OAuth access and refresh tokens for connected Instagram, Threads, TikTok, and X accounts are encrypted at rest using AES-256-GCM before being written to the database. Each token is encrypted with a unique initialization vector and authentication tag, and is only decrypted in memory at the moment it is needed to make a publish request to the relevant platform API.

API key handling

OmniPost API keys are shown to you in full exactly once, at creation time. After that, we store only a salted hash of the key (never the plaintext value) and display a short prefix (for example, op_live_9f3a…) so you can identify which key is which in the dashboard. If you lose a key, it cannot be recovered — you must revoke it and create a new one.

Infrastructure practices

Least-privilege access — production database and infrastructure access is limited to personnel who need it, and scoped as narrowly as practical [Access Control Placeholder].
Audit logging — every API request made against the OmniPost API is recorded (method, path, status code, duration, and the associated workspace/API key) in an internal request log, which we use to detect abuse, debug issues, and support security investigations.
Environment isolation — API keys are scoped as either LIVE or SANDBOX; sandbox requests never reach a real connected platform account.
[Additional infrastructure practice placeholders: backups, vulnerability scanning, dependency update cadence, incident response process.]

Subprocessors

We use a limited number of subprocessors to operate OmniPost. This list will be kept up to date as our infrastructure is finalized:

Hosting / compute — [Hosting Provider Placeholder]
Database — [Database Provider Placeholder]
Payment processing — [Payment Processor Placeholder]
Transactional email — [Email Provider Placeholder]

Responsible disclosure

If you believe you've found a security vulnerability in OmniPost, please report it to [Security Contact Email]. Please include enough detail to reproduce the issue, and avoid accessing, modifying, or deleting data that isn't yours. We will acknowledge reports within [Response Time Placeholder] and aim to keep you informed as we investigate and remediate.