Security Practices

Last updated: 18 October 2026

Your social accounts are valuable, so we treat their security as the most important part of PilotPost. This page describes the practical measures we use today.

1. Encryption

  • Every page and API call runs over HTTPS (TLS), with certificates renewed automatically.
  • Social network access tokens and other credentials (such as bot tokens and app passwords) are encrypted at rest with AES-256-GCM.
  • Passwords are never stored in readable form: we keep only a salted bcrypt hash.

2. Your account

  • Two-step verification with an authenticator app is available on every account, and required for administrators.
  • Repeated wrong codes temporarily lock two-step login.
  • Password-reset links work once and expire after 60 minutes.
  • “Continue with Google” lets you sign in without a PilotPost password.
  • For most networks you log in on the network's own page, so we never see your social media passwords.

3. Infrastructure

  • Servers are hosted in the EU by Hetzner, a provider certified to ISO/IEC 27001.
  • Server access uses SSH keys only (no passwords), with automatic blocking of repeated login attempts.
  • The application's internal services aren't exposed to the internet; only the secure web front door is.
  • The database is backed up automatically every day.

4. Application safeguards

  • Each customer can only see and use their own data and connected accounts.
  • Connecting a network uses signed, expiring requests, so a connection can't be hijacked.
  • Free tools have daily usage limits to prevent abuse.
  • Analytics and advertising scripts only load after you accept cookies.

5. Your part

  • Use a unique password and turn on two-step verification.
  • Remove connected accounts you no longer use on the Accounts page.
  • Keep team logins to people who need them.

6. Reporting a security issue

If you think you've found a vulnerability, please email support@pilotpost.social with the details and give us a reasonable time to fix it before sharing it publicly. Please don't access other people's data or disrupt the Service while testing. We're grateful for responsible reports.

Security Practices