security
How we keep your work safe
Plain facts about how we protect your account, your files and your sites’ data. No badges, just what the app does.
AES-256-GCM
encryption for the API keys you connect
scrypt
hashes in place of passwords
14 days
and every session ends
Every night
a backup, with a second copy kept apart
Data
What you connect and what you make, kept out of the wrong hands.
Keys encrypted at rest
The API keys your workspace connects are stored encrypted with AES-256-GCM and read only on the server, when a call needs them.
Files for the right people
Uploads, pictures and site backups are served only to the people allowed to see them. Knowing a file's address is not enough.
Other sites' HTML cleaned
Posts read from other sites are cleaned before they are shown: scripts, frames and anything else that could run are taken out.
Access
Who gets in, and what they may do once they are in.
Passwords stored as scrypt hashes
We never keep a password, only its scrypt hash, and an unknown email takes as long to check as a known one.
Sessions that end
A session is a signed cookie that ends 14 days after sign-in. Changing a password signs out every other device.
Sign out everywhere
One click in Settings ends every session but the one you are using, wherever it was opened.
Sign-in attempts limited
Repeated failed sign-ins for one email or from one address are refused for a while, and failed tries are shown to admins.
Roles and permissions
Your admin decides what each role may do. Every action checks the person's role on the server, so a change applies at once.
Sharing you can take back
Share with a person, a team or everyone, and revoke it at any time. Leaving a team ends access to what was shared with it, at once.
Activity
A clear record of who did what, and what it cost.
An activity log
What people do in the workspace is logged with who did it and when, in a log your admins can read. Passwords, keys and the text of your work are never written to it.
Budgets for AI
Admins set a monthly AI budget for each person and each feature. Every model call and picture is recorded with who made it and what it cost.
Infrastructure
How the app talks to the internet, and how your data is backed up.
Guarded fetching
Any page address a person types is fetched through a guard that refuses private and internal network addresses, checked again at every redirect.
Nightly backups, in two places
The database is backed up every night, with a second copy in a separate, private storage bucket in Germany.
Not shown inside other sites
Other websites cannot load the app inside a frame, so its buttons cannot be hidden under someone else's page.
Privacy
Your data is used to serve you, and for nothing else.
Google data, read-only
Search Console is connected read-only and used only to show you your numbers, following Google's API Services User Data Policy, including its Limited Use rules.
Never sold, never used to train AI
Your Google data is never sold, never used for advertising and never used to train AI models.
Your work stays yours
What you make belongs to your account, and you choose who else it is shared with.
Report a security issue
Found something that looks wrong? Write to us with what you found and how to see it. Please tell us before you share it anywhere else, so we can fix it first.
[email protected]The fine print
What we collect, why, and the terms you use the app under.
get started
Make every post your best performer
Research, write, design and watch every post in one workspace, built with the editors who use it.