Security and privacy

Robopost connects to your social accounts and holds your posts, media and team. This page explains how that access is protected and what you can do to keep your account safe.

How you log in

• You log in with an email and password, with Sign in with Google, or with a login link sent to your email.
• Accounts created with a password must confirm their email address before they can log in.
• Changing your login email or your password requires your current password, or a fresh Google sign-in if you use Google.

See Profile and login.

Who in your team can see what

Each team member has rights that decide which parts of the app they can use, and you can limit each member to certain channels. Admins can always use every channel. Removing a member ends their access to the team. See Team members and roles.

Sub teams keep each client or brand separate: people invited to a sub team see only that sub team. See Brands and sub teams.

How your channels are connected

For most networks, you connect a channel on the network's own login and permission page, and the network asks you which permissions to grant. You never type that network password into Robopost.

Where a network needs a password, use a password made for apps, never your main one: a Bluesky App Password, or a WordPress Application Password. See Connect a channel.

How payments are handled

You pay on Stripe's checkout page, and you manage your card and invoices on Stripe's billing page. Your card details are entered with Stripe, not in Robopost.

How your data is protected

• Traffic between your browser and Robopost is encrypted with TLS (versions 1.2 and 1.3).
• Stored data is encrypted at rest with AES-256.
• Access to data is limited to authorized users through role-based permissions.
• Systems are monitored and patched regularly, and a defined incident response plan covers security incidents.
• Regular penetration tests and vulnerability scans look for weaknesses.

How long post history, videos and files are kept is on Storage and history retention.

Keep your account safe

• Use a strong password that you don't use anywhere else, or log in with Google.
• Give Admin only to people who need it, and review rights when someone changes role.
• Remove members as soon as they leave your organization.
• Treat API keys like passwords. Don't share them, and delete the ones you no longer use: on the Team page, click Manage API Keys. See API authentication.
• Never send your password, API keys or app passwords to anyone, including support. Support never needs them.

Report a security problem

If you think someone else has access to your account, change your password, review the members of your teams, and contact support. Do the same to report a vulnerability.

Next

Delete your account: what happens to your data when you leave.