How we secure your data.

Transport and encryption

• All traffic is HTTPS (TLS 1.3) with HSTS enabled.
• Passwords are hashed with scrypt, a memory-hard function chosen to make offline cracking expensive.
• OAuth tokens, API keys, and connected-account credentials are encrypted at rest with AES-256-GCM (random IV, authentication tag) before being stored. They are decrypted just-in-time at publish or token-refresh, and session tokens are never serialised to the browser.

Authentication

• Step-up verification is on by default for every password account: a sign-in from a device we haven't seen before requires an emailed one-time code. Trusted devices are remembered for 30 days.
• An authenticator app (TOTP) can be enabled as a stronger second factor.
• Sign-ins from a country absent from your recent history trigger an alert email.
• Authentication endpoints are rate-limited independently of the rest of the API — five sign-in attempts per minute, three password-reset requests per five minutes.

Access control

• Every workspace has role-based access. Three roles ship by default (admin, designer, editor) and you can define your own with granular permissions across templates, posts, articles, analytics, workspace settings, and membership. A member with no role assigned gets no permissions — there is no implicit read-everything tier.
• Permissions are checked at the auth boundary and re-checked in every server action before any mutation. Every query is scoped to a single workspace at the data layer.
• Production database and infrastructure access is limited to a small number of engineers, scoped per-role, and logged.
• SAML / OIDC single sign-on is not available yet. It's on the roadmap for Enterprise — email contact@podiumdigital.rs if it's a blocker for you and we'll tell you where it stands.

Audit trails

• Workspace actions are recorded to a per-workspace audit log against a fixed action vocabulary, readable in-app under Manage → Activity.
• Account-security events (sign-in, new device, password change, MFA changes, session revocation) are recorded separately against the user. We store a salted hash of the IP address and a coarse country derived from a self-hosted geolocation database — never the raw IP.

Infrastructure

• Hosted on EU-region cloud infrastructure. Application, worker, and data tiers all run in the same region — no data leaves the EU during normal operation.
• Media assets are kept in private object storage with access-controlled ACLs; public delivery is via short-lived signed URLs only.
• A full database backup runs daily at 03:00 UTC and is stored encrypted in object storage under a lifecycle retention policy. Our recovery commitment is an RPO of 24 hours or better and an RTO measured in hours. We do not currently offer point-in-time recovery.
• Specific sub-processors are listed in our Data Processing Addendum.

Third parties

We connect to each platform's official API when you publish — Meta Graph for Instagram, Facebook Pages and Threads, plus the X and TikTok APIs. Access tokens are stored encrypted and refreshed automatically; we never request permissions beyond what's needed to create the posts you author.

We use no advertising trackers and sell no data, on any surface. For clarity about what we do run: this marketing site uses Google Analytics, which only loads after you accept analytics cookies. The product itself uses Sentry for error monitoring and Microsoft Clarity for product usage; neither is used for advertising. Every processor is named in the DPA.

Disclosure

Found something? Please disclose responsibly to contact@podiumdigital.rs with reproduction steps. We'll acknowledge within two business days and keep you updated on the fix. We don't have a paid bounty programme yet, but genuine findings get a public mention (with your permission) and our gratitude.

Contact

Security questions, audit requests, or vendor security reviews — email contact@podiumdigital.rs.