How PostOneGo keeps your accounts safe
You're trusting us with the keys to your audience. Here's exactly what we do with them.
Your social accounts
We never see your passwords
You connect each account on the platform's own sign-in page. PostOneGo only receives the access the platform grants, and only the permissions publishing needs.
Tokens are encrypted
Access tokens are encrypted with AES-256-GCM before they're stored. They're never sent to your browser and never written to logs.
Disconnect means delete
When you disconnect an account, its tokens are deleted.
Official APIs only
No browser automation, no scraping. Every post goes through the platform's own publishing API.
Your PostOneGo account
Verified email
New accounts confirm their email address before they can sign in.
Secure sessions
Sessions use HttpOnly, Secure cookies that last 14 days and are revoked when you reset your password.
Rate limits
Sign-in, sign-up and password reset are rate limited, and so is the rest of the API, per user and per IP address.
Separate sign-ins
Signing in to PostOneGo with Google never grants access to your YouTube channel. That's a separate, explicit connection.
Your content and your team
Workspace isolation
Every request checks that you belong to the workspace, and every query is scoped to it. Data from another workspace behaves as if it doesn't exist.
Roles
Viewers can read, editors can write and schedule, and only owners and admins can disconnect accounts or change settings.
Verified uploads
Uploads go straight to storage through short-lived signed links. If a file changes after upload, PostOneGo refuses to publish it.
API keys
Creating an API key needs a recent sign-in. Keys can be revoked at any time, and a password reset revokes all of them.
Found a problem?
Email divv@divvlaunches.com with the details. We'll reply and fix it.