Security and data
What we hold, and what we do not.
Vexo posts under your company name, so the question of who can reach it matters more than what it writes. Everything below names the mechanism behind it, and the last section is the one your reviewer will actually ask about.
What is stored, and how
Network tokens are encrypted before they are stored
The access and refresh tokens for LinkedIn, X, Meta, TikTok, YouTube and Reddit are sealed with AES-256-GCM under a key held outside the database, and the service refuses to start in production without one. A database dump on its own does not let anybody post as you.
Passwords are hashed with bcrypt
Cost factor 12, per-password salt, never reversible. Most accounts have no password at all because they sign in through Google, LinkedIn or X, in which case we hold no credential of yours.
Sessions are short and refreshable
An access token lasts fifteen minutes and a refresh token thirty days. Signing out ends both.
Every row belongs to one workspace
Drafts, accounts, analytics, prospects and audit entries are keyed to a workspace and every query is scoped to it on the server. There is no shared table a filter could be forgotten on.
Who can do what
Four roles, checked on the API
Owner, admin, editor and viewer, set per workspace. The check runs on the server, so a viewer cannot publish by finding the URL the button would have used.
Approval is the default
Drafts move through ready for review, approved, then scheduled. A new workspace holds everything for a person to read. Turning that off is a deliberate choice somebody makes, not a setting they inherit.
Actions are written down as they happen
Who connected an account, who approved a post, who changed the schedule, and when. Recorded per workspace at the time, not reconstructed from logs afterwards.
We do not post without a granted permission
Publishing is refused unless the stored token actually carries the network permission it needs. A connection made before a permission was added is caught before a post fails in public.
Who else sees your data
Every third party that receives customer content, including the model provider. Nothing here is a placeholder for a longer list held somewhere else.
- Google Cloud
- Hosting and the database. Run and Cloud SQL.
- OpenAI
- Writing drafts, and generating images for posts. Receives your brand description, products and post topics.
- Stripe
- Payments. Card details go to Stripe directly and never reach Vexo.
- Netlify
- Serves the website in front of the application.
- The networks you connect
- LinkedIn, X, Meta, TikTok, YouTube and Reddit receive whatever you publish to them, under their own terms.
- Canva and Slack
- Only if you connect them, and only what those features need.
Your content is not used to train anyone’s models, and we do not sell it. What a connected network does with what you publish to it is governed by that network’s own terms.
Leaving
Disconnecting a network deletes the stored tokens for it, and Vexo stops being able to reach that account at all. Deleting a workspace removes everything belonging to it: drafts, connected accounts, analytics, uploaded media and the audit trail, by database constraint rather than by a cleanup job that has to be remembered. Posts already published stay on the networks, because they are the network’s now, and deleting them is done there.
What Vexo does not have yet
Listed here rather than left out, because a security page that only says what went well is not a security page.
No SOC 2, ISO 27001 or HIPAA attestation
We hold none of these today. If your procurement process requires one, Vexo will not pass it yet, and we would rather you knew that now than after a trial.
No SAML or SCIM yet
Sign-in is email and password, Google, LinkedIn or X. There is no SSO against your identity provider and no automated deprovisioning. Removing somebody is a person removing them from the workspace.
No customer-managed keys, no data residency choice
Everything runs in one region under keys we manage. If your data has to stay somewhere specific, it cannot yet.
No third-party penetration test on file
The application has not been tested by an outside firm. There is no report to send you, and we will not describe internal review as though it were one.
Reporting something
If you have found a vulnerability, write to security@touchbasetechnologies.com with enough detail to reproduce it. We will confirm receipt within two working days. We do not run a paid bounty and will not pretend otherwise.
Talk to us about a rollout