How OmniPosts protects your accounts

How we protect your account, your channel credentials and your content: encryption, EU hosting, backups, access control, and what happens if something goes wrong.

Encryption

• In transit: all traffic to OmniPosts and from us to the platforms uses HTTPS (TLS).
• At rest: every channel credential — OAuth access and refresh tokens, Bluesky app passwords, Telegram bot tokens — is encrypted with AES-256-GCM before it is stored, using keys kept separately from the database. Credentials are never written to logs and are never shown back to you after you enter them.
• Passwords for your OmniPosts account are stored only as a slow one-way hash.

Where your data lives

Our servers and database are hosted in the European Union. Our subprocessors are listed on the Subprocessors page.

Keeping less

• Raw data we fetch from platforms (for example, like and repost counts) is kept for at most 30 days, in a separate store, and then deleted by an automatic job. We keep only the derived numbers we compute, tied to our own record of your post.
• Where a platform sets a shorter limit, the shorter limit applies. For example, LinkedIn member activity data is kept no longer than 48 hours, Page reporting data no longer than one year, and other LinkedIn members' profile data is never stored.
• Disconnecting a channel deletes its credentials and its raw platform data immediately.

Backups

Backups contain customer-authored content and account records only; raw platform payloads are excluded. Backups rotate every 30 days. After any restore we re-run deletion and purge jobs before the service accepts traffic, so data you deleted does not come back.

Access control

• Every request acts for exactly one organisation; one customer can never read another's data.
• Staff access to production is limited to the people who operate the service, uses individual accounts with multi-factor authentication, and is logged.
• API keys are shown once at creation, stored only as a hash, and can be revoked at any time. Webhooks are signed (Standard Webhooks, HMAC-SHA256).
• The web app uses HttpOnly, Secure cookies and a request header check against cross-site request forgery.

Incidents

If a personal data breach occurs, we contain it, assess it, and notify the relevant supervisory authority within 72 hours where GDPR requires it, the Data Protection Board of India as required by the DPDP Act, and affected users without undue delay.

Reporting a vulnerability

Email join@omniposts.dev with the subject "Security". Please give us reasonable time to fix the issue before disclosing it. We will not take action against good-faith research that avoids privacy violations and service disruption.