Passkeys and sessions
Sign in with a passkey first (WebAuthn). Passwords remain as recovery. Idle sessions sign out after 1 hour. You can review and revoke devices in Settings → Security. Publish, disconnect, and impersonation require a short step-up.
Vaulted Meta tokens
Instagram, Facebook Pages, and Threads connect through official Meta login. Bluesky uses an app password, Mastodon signs in on your server, Telegram uses your bot token, and LinkedIn uses LinkedIn sign-in, including optional Company Pages. Access tokens are stored with AES-256-GCM. Connection health shows reconnect status.
Workspace isolation
Content, inbox, and CRM leads stay in your tenant with row-level security. Lead ads persist to CRM without logging personal fields. We do not send cold outbound DMs. Inbox replies stay inside Meta's 24-hour window.
Reporting issues
Found a security issue? Email support.deepsocials@wearedeepworks.com for responsible disclosure. We take reports seriously.