Security at Postid
This page describes controls visible in the current product and codebase. It does not replace a contract, audit report or compliance assessment.
Implementation review date: 2026-08-29
Control ledger
Access and refresh tokens are issued in HttpOnly cookies. State-changing cookie-authenticated requests pass CSRF validation.
AuthCookies · CsrfMiddleware
The CSRF double-submit cookie is readable by the browser by design; authentication cookies are not.
Connected-account tokens are encrypted with AES-GCM before storage and decrypted only for supported platform operations.
TokenEncryptionService
This is an implemented encryption control, not a certification claim.
Authenticated requests resolve an active tenant/workspace and data access is scoped to that context.
TenantMiddleware · tenant-aware repositories
Isolation depends on valid membership and the active workspace selected for the session.
Protected actions use hierarchical workspace roles and explicit permission authorization.
PermissionAuthorizationHandler · MemberPermissionService
Roles are the product’s defined Viewer, Editor, Admin and Owner model; custom enterprise roles are not claimed.
Responses apply content-type, framing, referrer, permissions and Content Security Policy headers.
SecurityHeadersMiddleware
Headers reduce browser attack surface; they do not prove the absence of every vulnerability.
Sensitive authentication flows use rate-limit controls backed by the configured infrastructure.
AuthEndpointRateLimiter
No uptime, DDoS absorption or SLA guarantee is implied.
Preview generation, caption calculation, engagement calculation and image resizing run in the browser. Tools may read the public platform-constraint catalogue; they do not upload the entered caption or selected image in their default flow.
Open free toolsPostid does not claim SOC 2 or ISO certification, legal equivalence to GDPR/KVKK compliance, a published penetration-test result, a data-residency guarantee or a public uptime SLA here.
Report a security concern