Security

Network tokens

OAuth tokens for the accounts you connect are encrypted at rest with AES-256-GCM, a key that never lives in the database, and a per-record nonce. A token is only ever decrypted in memory, inside the one call that needs it - publishing a post, refreshing a token, or disconnecting an account - and is never returned by the API, written to a log, or shown in the dashboard.

Payments

Card numbers never reach our code. Checkout and the customer portal are hosted by Paddle or WayForPay; we keep only a customer id, subscription id, plan, status, renewal date and the card’s last four digits for your own reference.

Tenant isolation

Every database query is scoped to a workspace. A post, file or account that belongs to someone else’s workspace answers "not found" - the same answer as one that does not exist at all - rather than a permission error that would confirm it exists.

Media

Files are served only through a signed, time-limited URL tied to the specific file; the storage directory itself is never listable. Uploaded images are re-encoded on our servers before anything is kept, which strips embedded location data and scripts.

MCP and the public API

API keys and MCP connections use OAuth 2.1 with PKCE where relevant, are scoped to read or read-and-write, and every action they take is written to your workspace’s own audit log. Nothing that changes members, billing or connected accounts is reachable this way - not restricted, simply not built into the surface at all. See how MCP works.

Infrastructure

HTTPS everywhere with HSTS; containers run as a non-root user with no unnecessary privileges; the database and cache are not reachable from outside the server. Dependencies are scanned on every change; a secret accidentally committed is caught before it reaches the repository’s history.

Backups

The database and media are backed up nightly to encrypted object storage in a separate region, restorable into a fresh database without touching the live one. A backup that has never been restored is not a verified backup - regular restore drills are on our own checklist, not yet on a fixed schedule.

Reporting a problem

Write to security@dropslate.top. We will confirm receipt within 48 hours.