> ## Documentation index
> Fetch the complete documentation index at: https://dash.robopost.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

Robopost connects to your social accounts and holds your posts, media and team. This page explains how that access is
protected and what you can do to keep your account safe.

## How you log in

- You log in with an email and password, with **Sign in with Google**, or with a login link sent to your email.
- Accounts created with a password must confirm their email address before they can log in.
- Changing your login email or your password requires your current password, or a fresh Google sign-in if you use
  Google.

See [Profile and login](https://dash.robopost.app/docs/account/profile-and-login.md).

## Who in your team can see what

Each team member has rights that decide which parts of the app they can use, and you can limit each member to
certain channels. Admins can always use every channel. Removing a member ends their access to the team.
See [Team members and roles](https://dash.robopost.app/docs/account/team-members-and-roles.md).

Sub teams keep each client or brand separate: people invited to a sub team see only that sub team. See
[Brands and sub teams](https://dash.robopost.app/docs/account/brands-and-sub-teams.md).

## How your channels are connected

For most networks, you connect a channel on the network's own login and permission page, and the network asks you
which permissions to grant. You never type that network password into Robopost.

Where a network needs a password, use a password made for apps, never your main one: a Bluesky App Password, or a
WordPress Application Password. See [Connect a channel](https://dash.robopost.app/docs/channels/connect-a-channel.md).

## How payments are handled

You pay on Stripe's checkout page, and you manage your card and invoices on Stripe's billing page. Your card details
are entered with Stripe, not in Robopost.

## How your data is protected

- Traffic between your browser and Robopost is encrypted with TLS (versions 1.2 and 1.3).
- Stored data is encrypted at rest with AES-256.
- Access to data is limited to authorized users through role-based permissions.
- Systems are monitored and patched regularly, and a defined incident response plan covers security incidents.
- Regular penetration tests and vulnerability scans look for weaknesses.

How long post history, videos and files are kept is on
[Storage and history retention](https://dash.robopost.app/docs/account/storage-retention.md).

## Keep your account safe

- Use a strong password that you don't use anywhere else, or log in with Google.
- Give **Admin** only to people who need it, and review rights when someone changes role.
- Remove members as soon as they leave your organization.
- Treat API keys like passwords. Don't share them, and delete the ones you no longer use: on the **Team** page,
  click **Manage API Keys**. See [API authentication](https://dash.robopost.app/docs/api/authentication.md).
- Never send your password, API keys or app passwords to anyone, including support. Support never needs them.

## Report a security problem

If you think someone else has access to your account, change your password, review the members of your teams, and
[contact support](https://dash.robopost.app/docs/help/contact-support.md). Do the same to report a vulnerability.

## Next

[Delete your account](https://dash.robopost.app/docs/account/delete-your-account.md): what happens to your data when you leave.