How we keep your data safe.

Encryption

• In transit: TLS 1.2 or higher for every connection. Certificates issued by Let's Encrypt and auto-renewed by Caddy.
• At rest: OAuth tokens and other secrets are encrypted with AES-256-GCM before being written to the database. A unique IV per record; the symmetric key is held in a server environment variable outside the app image.
• Passwords: hashed with bcrypt (cost factor 10). We never see or store your password in the clear.

Access control

• Every workspace has its own members. Roles gate what each user can do inside each brand — owner, admin, editor, reviewer, viewer.
• Session cookies are HttpOnly, Secure, and SameSite=Lax.
• Suspicious logins are flagged. Workspace owners are emailed on new-device sign-ins (roadmap: this fires from a background job we haven't written yet).
• Admin access to the underlying servers is limited to named engineers with SSH key authentication. Root SSH is disabled.

Infrastructure

• Everything runs on our own dedicated infrastructure in the United States. No shared multi-tenant hosting.
• The application container, database container, and reverse proxy each run in isolated Docker networks. The database is not reachable from the public internet.
• The reverse proxy (Caddy) is the only inbound public path. Rate-limiting rules protect authentication and API endpoints.
• Operating system security updates are applied automatically (Ubuntu 24.04 LTS unattended-upgrades).

Data durability

• Nightly automated database backups, retained for 30 days.
• Backups are stored on a separate volume from the live database.
• Recovery is tested manually on request; automated recovery tests are on the roadmap.

Activity history

Every meaningful action in ManageSM is recorded — logins, connections, posts drafted, posts published, approvals granted, settings changed. You and your team can see the full history at any time. This isn't a cryptographically-sealed audit log (that's on the roadmap) but nothing is deleted from it in normal operation.

What we send to third parties

• Anthropic receives the text of your post drafts when you use AI drafting features, and nothing else. Under our agreement, Anthropic doesn't use API traffic to train models.
• Connected social networks receive the content you tell us to publish and read requests for the metrics on those posts. No cross-network sharing.
• Stripe (once billing launches) will handle payments. Card details never touch our servers.

Full list with locations and dates in the DPA sub-processor annex.

Application security

• Every dependency is version-pinned; the lockfile is committed and reviewed on updates.
• Automated dependency and CVE scanning on every build.
• Input validated at the boundary; SQL access goes through a parameterised query layer (Drizzle ORM) — no raw string concatenation.
• CSRF protection on state-changing endpoints. Content Security Policy in place.
• All authentication routes are rate-limited.

Reporting a vulnerability

Found something? Please email hello@managesm.com with “Security” in the subject. We aim to acknowledge within one business day and confirm the fix timeline within three. We do not currently run a paid bug bounty, but we will credit responsible reporters in our changelog with your permission.

Please don't attempt to access accounts other than your own, scan our systems with automated tools, or publish details of a vulnerability before we've had a chance to fix it.

On the roadmap

• SOC 2 Type II audit.
• SAML SSO and SCIM user provisioning.
• Per-workspace data residency options (EU, Canada).
• Cryptographically-sealed activity log.
• Automated backup restore tests.
• Two-factor authentication (TOTP + WebAuthn).

If any of these are a hard requirement for you, contact us and let us know. Real customer demand is what moves them up the roadmap.