What we protect, and how.

Your Meta access

• Connection goes through Meta's own sign-in windows: Facebook Login for Pages, and Instagram Login (or Facebook Login, through a linked Page) for Instagram, with the permissions listed on the home page; nothing else is requested.
• Page and Instagram access tokens are stored encrypted (AES-256-GCM) and are never shown in the dashboard or to an API key.
• You can revoke dmswift from your Facebook or Instagram settings at any time, and Meta's deauthorization and data-deletion callbacks are honored automatically.
• There is no browser automation and no stored Facebook password, ever.

Accounts

• Sign in with Google, or a password stored as a scrypt hash.
• Team members get roles; billing, team management and account deletion stay with the owner.
• An audit log records every account action, including those made by API keys and agents.

AI agents and API keys

• A key is weaker than the person who made it: only the scopes it was granted, optionally pinned to specific channels, and no access to account administration or other keys.
• Daily caps per key: 15 publishes, 30 comments and 100 private messages by default.
• Approval mode: a connection can be made to ask before anything is published.
• OAuth 2.1 with PKCE (S256) for MCP clients; access tokens last an hour and refresh tokens rotate on every use, so a replayed one ends the connection.
• Agents can never send follow-ups to recent conversations, and can only message people who wrote first, inside Meta's 24-hour window.

Data in transit and at rest

• HTTPS everywhere, with HSTS on this site.
• Outbound webhooks are signed with HMAC-SHA256 over a timestamp and the raw body, so a receiver can reject forgeries and replays.
• Rate limits per key, per user and per IP.
• Nightly database backups, with an off-site copy where configured.
• Where data is processed, and by whom, is listed on the subprocessors page.

Deletion

• Deleting your account is immediate and cancels the subscription.
• When a channel is disconnected, its data is deleted automatically after 90 days.
• Details of what is kept and for how long are in the privacy policy and on the data deletion page.

Reporting a vulnerability

Write to support@dmswift.com with "Security" in the subject, with enough detail to reproduce the issue. Please do not access other customers' data, and give us a reasonable time to fix the problem before you disclose it. We answer security reports within two business days.

Related