Legal
Security
An overview of the technical and administrative safeguards SOCIAL DM AI SYSTEM uses to protect your workspace, your connected Instagram account, and your customers' conversations.
Effective date: September 1, 2026
1. Account authentication
Passwords are hashed with Argon2id before storage; we never store a readable password. Sign-in creates a server-side session referenced by an HttpOnly, secure cookie, so the session can be revoked (for example on logout) without relying on the browser alone.
2. Workspace isolation
Every record -- products, conversations, messages, business knowledge, and connections -- is scoped to a single workspace, and access is checked against workspace membership on every request. One workspace cannot read or modify another workspace's data.
3. Protecting requests and webhooks
State-changing requests (like saving business knowledge or sending a reply) require a matching CSRF token in addition to a valid session. Inbound events from Meta are only trusted after verifying Meta's cryptographic signature on the request; unsigned or invalid webhook calls are rejected before anything is processed.
4. Protecting your Instagram connection
Instagram access tokens are encrypted before they are stored, not kept in plain text. Disconnecting an Instagram account destroys the locally stored, encrypted token.
5. Abuse prevention
Rate limiting is applied to protect the service and connected accounts from being overwhelmed or abused, including by automated or malicious traffic.
6. Data in transit
The service is designed to be served over encrypted (TLS/HTTPS) connections as provided by our hosting infrastructure; exact production hosting providers are confirmed separately before launch, as noted in our Privacy Policy.
7. Reporting a security concern
If you believe you have found a security vulnerability, please contact us through the support contact provided to your business account with enough detail to reproduce the issue, and avoid accessing or modifying data beyond what is needed to demonstrate it. We will work to acknowledge and address good-faith reports.
8. No absolute guarantee
No system or transmission method is completely secure, and we cannot guarantee absolute security. See our Privacy Policy for how we handle information more broadly.
9. Changes to this page
We may update this page as our security practices change. We will post the updated page here and revise the effective date.