Effective 2026-01-01
Security Overview
Operated by Xoxo Digitals. Contact: privacy@creatorpilotpro.com
This page is a compliance template. Replace placeholders (company name, address, emails, effective date) in apps/web/src/lib/legal-meta.ts or via NEXT_PUBLIC_LEGAL_* env vars, then have counsel review before relying on it.
1. Approach
SocialCreatorPilot is designed as a self-hosted / privately operated social publishing workspace. Security controls depend on both the application and your deployment environment. This page is a high-level overview, not a certification.
2. Application controls (typical)
- Authenticated sessions with HTTP-only cookies where configured.
- Role-based access within workspaces.
- Encryption of sensitive secrets (e.g., OAuth tokens, API keys) at rest when enabled by deployment configuration.
- Server-side validation of API requests; operational logging for incident response.
3. Operator responsibilities
- Keep OS, containers, and dependencies patched.
- Protect DATABASE_URL, MASTER_KEY, SESSION_SECRET, and platform app secrets.
- Use TLS on public endpoints and restrict admin access.
- Configure backups and retention consistent with your Privacy Policy.
4. Reporting vulnerabilities
Email security findings to privacy@creatorpilotpro.com (or a dedicated security@ address you configure). Please allow reasonable time for assessment before public disclosure.