Security

Last updated: 19 October 2026

You trust IGNIPOST with access to your social accounts and your customers' messages. This page explains how we protect that access and that data, what you can do to help, and how to report a security problem to us.

Encryption

In transit

All traffic between your browser and IGNIPOST uses TLS (HTTPS). Connections from IGNIPOST to the social networks and our service providers also use TLS.

At rest

Data stored on our servers and in file storage is encrypted at rest.

Access tokens

When you connect a social account, the network gives us an access token. We encrypt every token at rest with AES-256. Tokens are used only to perform the actions the features you turned on need.

Passwords

We never store your password in readable form. We store only a one-way hash, so no one at IGNITECH can see it. If you forget it, you reset it; we cannot send it to you.

Role-based access in your workspace

Team workspaces use roles, so each person sees and does only what their role allows. Workspace owners choose the roles and can remove a member at any time.

Our own access controls

• Only the IGNITECH staff who need it to run and support the service can access production systems.
• Administrative access is protected and limited to named staff.
• We look at customer content only when it is needed to provide support you asked for, to keep the service secure, or when the law requires it.

Infrastructure

Our servers are in the European Union (Germany) and sit behind Cloudflare, which filters traffic before it reaches them. Files are stored on Cloudflare R2.

Logging and monitoring

We keep security logs, including IP address and user agent, for up to 90 days. They help us detect unusual activity and investigate problems.

Backups

We back up our data regularly so we can recover from failures. Backups roll off within 35 days, so data you delete also leaves our backups within that time.

Incidents

If a security incident affects your personal data, we will tell you without undue delay. For customer data we process for you, we will notify you within 72 hours of becoming aware, as set out in our Data Processing Addendum.

Certifications

We do not currently hold security certifications such as ISO 27001 or SOC 2. We will update this page if that changes.

What you can do

• Use a strong password that you do not use on any other site.
• Give each team member the lowest role they need.
• Remove team members as soon as they leave.
• Disconnect social accounts you no longer use.
• Be careful with emails asking for your IGNIPOST password. We will never ask for it.

Report a vulnerability

If you find a security weakness in IGNIPOST, please email [email protected]. Include:

• a description of the issue and where it is;
• the steps to reproduce it;
• what an attacker could do with it.

While you research, please:

• access only the data you need to show the issue, and never other users' data;
• do not run denial-of-service tests, spam or social engineering;
• give us reasonable time to fix the issue before you share it publicly.

We will acknowledge your report, keep you informed while we work on it, and credit you if you wish. If you act in good faith and follow these rules, we will not take legal action against you for your research.

Contact

Security reports: [email protected]. Privacy questions: [email protected]. Read more in our Privacy Policy.