How your accounts are protected
You are handing us the keys to your social presence. Here is exactly what happens to them.
Your network tokens are encrypted at rest
Social access tokens are sealed with Fernet before they touch the database — they are never stored in plaintext. The encryption key is separate from the key that signs your session, so recovering one does not hand over the other.
Passwords are hashed, never stored
Passwords go through bcrypt with a per-password salt. Nobody at OneClickPosts can read your password, and a database copy would not reveal it.
We connect to each network directly
There is no reseller or aggregator between you and Instagram, Bluesky or YouTube. Your credentials are exchanged with the network itself over its official API, so your posts and your tokens are not sitting in a third party's system.
Publishing happens on our servers
Scheduled posts are published by a server-side worker, not by your browser. Closing the tab, losing signal or shutting the laptop does not affect a scheduled post.
Least access inside your team
Workspaces are isolated from each other, members carry a role, and an approval step can sit in front of anything going live. Someone who can draft does not have to be someone who can publish.
In transit
- HTTPS everywhere, TLS 1.2 and 1.3 only, with forward-secret cipher suites.
- HSTS, so browsers refuse to fall back to plain HTTP after the first visit.
- nosniff, clickjacking and referrer protections on every response.
What we don't claim yet
OneClickPosts is a young product. We are not SOC 2 or ISO 27001 certified, and we would rather say so than imply otherwise. If your organisation needs a security review, a DPA, or answers to a questionnaire before you can adopt a tool, write to us and you will get straight answers from someone who has read the code.
Found a vulnerability?
Report it privately and we will confirm receipt, keep you updated while we fix it, and credit you if you would like. Please don't test against other people's accounts or data.
support@oneclickposts.comSee also our Privacy Policy and Terms.