Data Isolation
Every record carries a workspace identifier. Access is enforced at the database level with row-level security policies.
Authentication
Sign-in uses email/password or Google OAuth. Sessions are short-lived JWTs refreshed by the client.
Platform Tokens
Tokens issued by social networks are stored server-side, scoped to a single workspace, and only used for configured actions.
Encryption
All traffic runs over TLS 1.2+. Data at rest, including uploaded media, is encrypted by the storage layer.
Access Control
Roles are stored separately from user profiles and checked with a security-definer function, preventing privilege escalation.
Backups
The database is backed up daily with point-in-time recovery. Infrastructure runs on managed, geographically redundant providers.
Reporting a vulnerability
Email security@stayuseful.app with reproduction steps. We acknowledge reports within two business days and will keep you updated until the issue is resolved. Please do not publicly disclose before we have shipped a fix.