Your clients' accounts, treated like they're ours
Postwoo holds the keys to dozens of client profiles. Here is how we protect them.
Encrypted tokens
OAuth tokens are encrypted at rest with libsodium under a server-side key, stored apart from account data, never returned by the interface or API, and deleted on disconnect.
Official OAuth flows
Authorization-code flow with PKCE where supported, single-use state tied to your workspace, and the minimum scopes each platform allows.
Scoped API access
API credentials are hashed, shown once, scoped to specific permissions and optionally specific clients, and revocable instantly.
Roles & isolation
Five roles plus per-client restrictions; every query is scoped to your workspace, and cross-tenant access returns nothing.
Audit trail
Every action — approvals, publishes, replies, settings, logins — is logged with actor, time and IP.
Idempotent publishing
Each publish is a single, tracked job. Timeouts park a post for verification instead of risking a duplicate.
Webhook signatures
Inbound platform webhooks are signature-verified; outbound webhooks to your tools are HMAC-signed.
Backups
Nightly encrypted database backups with retention, binary logs for point-in-time recovery, restore drills.
No scraping
We only call documented, approved platform endpoints — so your accounts never trip automation defences.
Found something?
Email security@postwoo.app with details and we'll respond within two business days. Please don't access data that isn't yours while testing.
Compliance notes
Postwoo's use of Google API data follows the Google API Services User Data Policy, including Limited Use. Meta, LinkedIn, YouTube and TikTok data is used only to provide the features you enable. See the privacy policy.
Ready to woo your clients?
Start free, connect a Google Business Profile, and see real reviews and metrics in the feed within minutes.