Social media scheduler security & trust
Because SkedCast, a social media scheduler, holds the keys to your connected accounts, we design every layer to protect them. Here is how we handle security, privacy, compliance, and accessibility.
Security
Tenant isolation, an encrypted token vault, and defense in depth.
Privacy
Data minimization, your control over connected accounts, and clear rights.
Compliance
Platform developer policies, GDPR/CCPA, and our certification roadmap.
Accessibility
Built to WCAG 2.2 AA — keyboard, contrast, and assistive-tech friendly.
Security
The controls below summarize how we protect your data. They reflect the architecture documented in our internal security design.
Tenant isolation (RLS)
Every tenant-scoped table is protected by row-level database security keyed to your agency, enforced by a least-privilege database role that cannot bypass it — so data never crosses between tenants.
Encrypted token vault
We store OAuth access and refresh tokens — never your platform passwords. Tokens are sealed with AES-256-GCM under a key derived separately for every tenant, decrypted only on the backend, and never logged or sent to the browser.
Encryption in transit & at rest
All connections use TLS 1.2+ (preferring 1.3) with HSTS, and data at rest — including the database and media storage — is encrypted.
Least-privilege access
Access follows least privilege with role-based controls and a separate, MFA-protected operator surface. Sensitive operator actions are gated and double-logged.
Audit logging
Security-relevant events — authentication, account connection, token refresh, role changes, and data export or deletion — are recorded in an append-only audit log keyed by tenant and correlation ID. Nobody in your workspace can edit or delete an entry; only our retention process removes them, after archiving entries older than 24 months.
Hardened by design
OAuth follows RFC 9700 (PKCE, short-lived tokens, refresh rotation); inputs are validated and queries parameterized; uploads are scanned and stripped of metadata; and SSRF, IDOR, and CSRF defenses are built in.
Roles, per-client access and approvals are covered on the team, roles and approvals page, and common questions are answered in the security FAQ.
How we handle your connected accounts
When you connect a social account, we complete the platform’s official OAuth flow and store the resulting access and refresh tokens — we never store or ask for your platform passwords. (Bluesky connects with an app password you create for SkedCast and Telegram with a bot token, since neither offers OAuth; neither is your account password.) Tokens are sealed with AES-256-GCM under a key derived separately for every tenant, are decrypted only by our backend services, and are rotated and refreshed automatically.
Disconnecting an account erases SkedCast’s stored copy of its tokens, and SkedCast asks the platform to revoke its access wherever the platform offers a way to do that. Instagram, Threads and Telegram offer none, so for those three networks the permission stays on the platform’s side until you also remove SkedCast in that platform’s app settings (for Telegram, remove the bot from your channel).
Privacy
We collect only what the product needs, use it only to provide the features you ask for, and put you in control.
SkedCast is the data processor for the content and connected-account data you bring; you remain in control of it. We do not sell personal data, we do not use your platform data for advertising or surveillance, and we retain it only as long as the feature needs it. You can disconnect any account at any time to erase the tokens SkedCast stores for it (and revoke access on the platform where it allows that, as described above), and request deletion of your account and all associated data.
- OAuth tokens only — never your platform passwords
- No selling of personal data; no ad targeting or surveillance use
- Data minimization — we keep only what the feature requires
- Self-service disconnect and a clear data-deletion path
For the full detail, see our Privacy Policy, Data Deletion page, and Sub-processors list.
Compliance
We build to certification-grade standards and comply with each connected platform’s developer policy.
SkedCast complies with the developer policy of every platform you connect — including the Google API Services Limited Use requirements for YouTube data — and supports GDPR and CCPA/CPRA rights for the data we process. Business and EU customers can request our Data Processing Addendum.
The following certifications are on our roadmap and are not yet in place:
In the meantime, our practices align with the OWASP Top 10 and ASVS Level 2, RFC 9700 for OAuth, and NIST SP 800-38D for encryption. See our Platform API Data Use & Compliance page and Data Processing Addendum.
Accessibility
SkedCast is built to be usable by everyone, targeting WCAG 2.2 AA across the product and this site.
Accessibility is a design requirement, not an afterthought. We build against WCAG 2.2 Level AA: full keyboard operability, visible focus indicators, semantic HTML and ARIA landmarks, sufficient color contrast, and status that is never conveyed by color alone. We support both light and dark themes and respect reduced-motion preferences.
- Keyboard-operable throughout, with a skip-to-content link and visible focus
- Semantic structure and ARIA landmarks for assistive technologies
- AA color contrast and status never signaled by color alone
- Light and dark themes, with reduced-motion support
Found an accessibility barrier? Email [email protected] and we will work to fix it.
Responsible disclosure
If you believe you have found a security vulnerability, please report it to [email protected]. We appreciate responsible disclosure: give us reasonable time to investigate and remediate before any public disclosure, and please do not access or modify data that is not yours while testing.
Social media scheduler security FAQ
- How secure is this social media scheduler?
- SkedCast isolates every tenant with row-level security, encrypts connected-account tokens in an AES-256-GCM vault, and encrypts data in transit and at rest. Access follows least privilege, and every sensitive action is audit-logged.
- Where are connected account credentials stored?
- OAuth tokens and platform credentials are stored in an encrypted token vault (AES-256-GCM), never in plain text, and are only decrypted in memory when a scheduled post needs to publish.
- How do I report a security vulnerability?
- Email [email protected] with the details. SkedCast follows responsible disclosure: we ask for reasonable time to investigate and remediate before any public disclosure.
Security you can build a business on
Sign up free — no credit card. You land on the Free plan, and you can start a one-time 7-day Studio trial from your workspace whenever you are ready. See how SkedCast protects every connected account.