Security

• We never ask for your passwords. Every network is connected through its own official sign in, and we receive an access token rather than credentials. You approve exactly what we may do at the moment you connect.
• Tokens are encrypted before storage. Access tokens are encrypted with AES-256-GCM and only then written to the database. Nothing that grants access to one of your accounts is ever stored in plain text.
• No encryption key, no connection. If the encryption key is not present, the app refuses to connect a real account rather than falling back to storing the token unprotected.
• Disconnecting deletes the token. Removing a channel deletes the stored record, the token with it. There is no archived copy to recover.

Accounts are handled by Clerk, an authentication provider. We never see or store your password. Sign in is protected against automated sign up attempts, and passwords found in known public breaches are rejected, so a password leaked somewhere else cannot be reused here.

• Traffic to and from the site is encrypted in transit over HTTPS.
• Every record belongs to one workspace, and every query is filtered by it on the server. Workspaces cannot see each other, including the separate workspaces an agency keeps for its clients.
• Data is stored in managed Postgres, hosted in the United States.

A review link lets someone approve posts without an account. Only a one way hash of the link is stored, never the link itself, so a copy of our database would not let anyone open one. Turning a link off takes effect immediately, and a link only ever reaches the one workspace it was created for.

• We never publish anything you did not write and schedule or send.
• We do not sell your data, and we do not sell access to it.
• We do not read your private messages. We read comments left on posts published through Mainspring Social, so you can answer them here.

We would rather tell you this than let a logo imply otherwise. Mainspring Social does not hold a SOC 2 report, and it is not a HIPAA business associate. We are a young product, and we will say so here on the day either of those changes rather than before.

If you believe you have found a vulnerability, email social@mainspringsoftware.com with enough detail to reproduce it. We will confirm we received it, and we will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before making it public.

Mainspring Social is a product of Mainspring Software LLC, a company registered in the United States. Questions about anything on this page go to social@mainspringsoftware.com.