Security

Last updated: 22 October 2026

This page describes how Social Muse (socialmuse.online) protects your account and your data. It describes the measures we have in place today. To report a security issue, see section 11.

1. Our approach

The server decides. Every request is authenticated, checked against your role and permissions, validated and checked against your plan on our servers. Screens hide actions you cannot take, but hiding is never the only protection.
Least privilege. People only see and change what their workspace Owner has given them access to.
Security is part of every feature, and is tested before each release.

2. Workspace isolation

Each workspace's data is kept separate from every other workspace's.
Row-level security is enabled on every table that holds customer data, so the database cannot be read directly from outside our servers, and our servers check workspace membership, role and permissions on every request.
AI memory is kept per workspace and is never shared between workspaces.

3. Accounts and access

Sign-in is handled by a managed authentication service (Supabase Auth). Passwords are stored only as secure hashes, never in plain text. You can also sign in with Google or Facebook.
Password reset links are single-use, work only on the reset page, and a successful reset or password change signs the account out on every browser and device.
Sessions can be ended remotely. Owners can sign out or block any collaborator; a blocked collaborator loses access immediately. Plans can limit the number of signed-in devices.
Permissions are checked on every request, so a removed permission takes effect on the person's next action.
Administrator access is separate: our Admin panel runs on its own address, requires two-step verification at every sign-in, gives each administrator only the permissions granted to them, and records every administrative action in an audit log.

4. Connected social accounts and secrets

Access tokens for connected social media accounts are encrypted at rest with AES-256-GCM, used only on our servers, never sent to browsers or apps, and never written to logs.
Disconnecting an account stops all use of its token at once. You can also revoke our access at any time from the platform's own account settings.
API keys and other secrets are kept only in our hosting providers' secret stores, are separate for each environment, and are never placed in client code or source control.
API keys you create for the Social Muse API are shown once and stored only as a hash.

5. Encryption and storage

All traffic to the Service uses HTTPS (TLS).
Uploaded images and videos are stored in private object storage and are only reachable through short-lived signed links.
We never see or store your full card number. Payments are handled by our merchant of record, Dodo Payments.

6. Application security

The Service is built to defend against common attacks, including:

Injection: parameterised database queries and validation of every input on the server.
Cross-site scripting: output encoding, and an allow-list sanitiser for rich text such as posts, blog articles and legal pages.
Server-side request forgery: outbound requests made for research and website crawling are restricted, and private network addresses are blocked.
Abuse and brute force: rate limits per address, person, workspace and endpoint.
Replays and duplicates: idempotency keys on actions that must not run twice, and signature checks with timestamps on incoming payment webhooks.
Malicious uploads: size limits, an allow-list of file types and a check of each file's actual content against its declared type.
Browser protections: strict cross-origin rules and security headers.

7. AI

Only the content needed for the action you request is sent to an AI provider.
Passwords, tokens and payment details are never put into AI requests or AI memory.
AI output is checked before it is saved, and nothing is published without approval unless an Owner turns on automatic publishing for a platform.

8. Monitoring and logging

Errors are monitored and alerts are raised for failures. Error reports are sent with personal data collection switched off, and sensitive fields are removed.
Important actions are recorded in activity and audit logs (who did what, when and to what). Passwords, tokens and keys are never recorded.

9. Reliability

Background work, such as publishing and video processing, runs in separate worker processes with automatic retries.
Our database is hosted on a managed database service with its own backup and recovery features.
Deleting something first removes it from the Service, so mistakes can be undone before it is permanently removed.
If an outage or maintenance on our side stops you from using a paid plan, our Refund Policy explains how we extend your plan.

10. How we build and release

Every change goes through review and automated checks (linting, tests, build), dependency vulnerability scanning, secret scanning and static code analysis before it is released.
Changes are tested in a separate development environment before they reach production.

11. Reporting a vulnerability

If you believe you have found a security vulnerability, please email support@socialmuse.online with the subject "Security" and enough detail for us to reproduce it. We will acknowledge your report within 5 working days and keep you informed of our progress.

We ask that you: give us reasonable time to fix the issue before disclosing it; avoid accessing, changing or deleting data that is not yours; avoid degrading the Service (no denial-of-service or large-scale automated testing); and do not use social engineering or physical attacks. We will not take legal action against anyone who reports a vulnerability in good faith and follows these rules.

12. If something goes wrong

If a personal data breach affects your data, we will notify you without undue delay, and for customers covered by our Data Processing Agreement within 72 hours of becoming aware of it, with what we know and what we are doing about it.

13. Compliance

We design our data handling to meet the EU and UK GDPR, the CCPA/CPRA, India's Digital Personal Data Protection Act and Nepal's Individual Privacy Act. Social Muse is not currently certified under any third-party security standard (such as SOC 2 or ISO 27001). Our Privacy Policy and Data Processing Agreement give more detail.

14. Contact

Security questions: support@socialmuse.online, or Help in the app after you sign in.