Trust and operational security

Security for Connected Social Publishing

Postifys connects to Facebook, Instagram, YouTube, Pinterest, LinkedIn, and TikTok so your team can publish through the dashboard, REST API, or n8n. This page explains how account access, token handling, revocation, and vulnerability reporting work—without exposing sensitive infrastructure details.

Create Account Report a Vulnerability

Reviewed: 23 July 2026

Quick answer

How does Postifys handle security?

Postifys stores connected-account credentials server-side for the Postifys user who authorized them, uses those credentials only for requested publishing and account operations, and lets you disconnect access from Postifys settings. You should also revoke access inside each social platform when you permanently stop using a connection.

Connected accounts

Token storage and protection

Server-side storage

OAuth tokens and related connection metadata are stored with your Postifys account on the server. Publishing requests use the connected account you select; tokens are not intended to appear in public HTML or marketing pages.

Least necessary use

Tokens are used to complete publishing, account listing, refresh, and related product operations you initiate through the dashboard, API, or n8n. Platform scopes and account types still limit what each connection can do.

Transport security

Public Postifys traffic is served over HTTPS on the canonical hostname https://postifys.com. Prefer that hostname for bookmarks, embeds, and integrations.

Operational boundaries

Private media, dashboard routes, and API endpoints that require authentication are not meant for open indexing. Keep API keys private and rotate them if they are exposed.

Access control

How to revoke access

  1. Open Postifys settings and disconnect the social account you no longer want available for publishing.
  2. In the social platform’s security or connected-apps settings, revoke Postifys access if you are permanently leaving the integration.
  3. If you used an API key in automation, delete or rotate that key inside Postifys and update your workflows.
  4. For account deletion or privacy requests, email info@postifys.com.

Disconnecting inside Postifys stops future publishing through that connection. Platform-side revocation is still recommended when you permanently remove access.

Responsible disclosure

Report a vulnerability

If you believe you found a security issue in Postifys, email info@postifys.com with:

What to include

A clear description, affected page or endpoint if known, and steps to reproduce.

What to avoid

Do not send customer tokens, private media, or unrelated personal data in the report.

What happens next

We review reports, prioritize confirmed issues, and follow up when additional detail is needed.

FAQ

Security questions

Connected-account tokens are stored server-side with the Postifys account that authorized them and are used for requested publishing and account operations.

Yes. Disconnect from Postifys settings and revoke access in the social platform’s own security settings when you permanently stop using the connection.

Email info@postifys.com with a clear description, affected URL or endpoint if known, and reproduction steps. Do not include customer tokens or private media.

Publish with clear account control

Connect only the accounts you need, monitor publishing history, and disconnect access when a workflow ends.

Create a Postifys Account Read Privacy Policy