# Security

Agencies connect their clients' social accounts to Shager. We treat that access as the most sensitive thing we hold. This page describes what we do today. It is not a certification.

## Encryption

- **In transit:** every connection, to the website, the app and the networks' APIs, uses TLS (HTTPS). Certificates come from Let's Encrypt.
- **At rest:** social network access tokens are encrypted in the database with **AES-256-GCM**. Passwords are stored only as salted hashes, never in plain text.

## Access to social accounts

- **Least privilege:** we request only the OAuth permissions each feature needs, and we explain them when you connect.
- **You stay in control:** you can disconnect an account in Shager at any time, which deletes its tokens immediately (for YouTube, they are also revoked at Google). You can also revoke access from the network's own settings.
- **Official APIs only:** Shager never asks for your social network passwords and never uses browser automation.

## Hosting

- Servers are hosted by Hetzner Online GmbH — Helsinki, Finland (EU), in the European Union.
- Media files are stored on our own servers, not with a third-party storage provider.
- Server backups are taken every day. Deleted data disappears from backups within 30 days.
- Access to production servers is limited to the operator. Login uses SSH keys only; password login is disabled.
- A firewall allows only web and SSH traffic, and operating system security updates are installed automatically.

## In the app

- Each workspace's data is separated from other workspaces.
- Team roles (owner, admin, member, and per-workspace manager, editor or viewer) control who can see each client and who can connect accounts and publish.
- Sign-in sessions use secure, HTTP-only cookies.
- Client approval links carry a random token that we store only as a hash. Each link expires, can be revoked, opens a single post only, and can never be used to sign in.

## Privacy by design

- Short-link clicks are counted without storing IP addresses, using a one-way visitor code that rotates daily.
- No analytics, advertising or third-party trackers on our site.
- The AI writing assistant receives only the text you choose to send it.

## What we do not claim

We do not currently hold SOC 2, ISO 27001 or any other security certification. If your procurement process needs a security questionnaire answered, write to yaniv.presler@gmail.com.

## Reporting a vulnerability

If you think you have found a security problem in Shager, please email yaniv.presler@gmail.com with the details and how to reproduce it. We ask that you:
- give us reasonable time to fix it before you disclose it publicly;
- do not access, change or delete data that is not yours, and stop as soon as you reach any;
- do not run denial-of-service tests, spam, or social engineering against us or our customers.

We will confirm receipt, keep you updated, and will not take legal action against good-faith research that follows these rules.

## If something goes wrong

If a personal data breach affects your data, we will notify affected customers without undue delay, and within 72 hours where the law or our [DPA](/en/dpa) requires it.

---
Source: https://shager.ai/en/security