Security
Security & reliability, built in — on every plan.
Your inbox holds customer conversations and your channel tokens hold the keys to your brand. Here's how we protect both.
Two-factor sign-in
Authenticator apps and recovery codes; organizations can require 2FA for everyone.
Encrypted credentials
Tokens, channel credentials, AI keys and webhook URLs encrypted at rest (AES-256-GCM); API keys hashed.
AI that shows its work
Approval cards list every detail of an AI action, and what you approve is exactly what runs.
Activity log
Who did what, when and from where — with filters and CSV export.
Tenant isolation
Enforced at the database layer, with permission checks on every page, socket and API call.
Connection health
Accounts re-checked every 6 hours, and posts due soon get a pre-flight check.
Privacy requests
Export or erase everything about one contact, with an audit trail.
Safe outbound calls
Workflow HTTP steps, MCP servers, site crawls and webhooks can’t reach private networks.
Responsible disclosure
Found a vulnerability? Tell us.
Email [email protected] with steps to reproduce. Please give us reasonable time to fix the issue before sharing it, and only test against accounts you own.
- Our security.txt is published at /.well-known/security.txt
- Security testing is allowed only with permission, as set out in our Acceptable Use Policy
- Data processing terms are in our DPA
- How we handle personal data is in our Privacy Policy
Security questions
How are channel tokens and API keys stored?
Tokens, channel credentials, AI keys and webhook URLs are encrypted at rest with AES-256-GCM. Open Motives API keys are stored hashed, so they can’t be read back.
Can we require two-factor sign-in?
Yes. Everyone can use an authenticator app with recovery codes, and organizations can require 2FA for every member.
How is one customer’s data kept apart from another’s?
Tenant isolation is enforced at the database layer, and permission checks run on every page, socket and API call.
Can we handle data subject requests?
Yes. You can export or erase everything about one contact, and the action is recorded in an audit trail.
Is there a data processing agreement?
Yes — see our Data Processing Addendum. A countersigned copy is available from [email protected].
Made for agencies, support teams, creators, small businesses, online stores.
Run your social media from one open workspace.
Start on the Free plan, connect your channels and invite your team when you're ready.
Free plan · No credit card · Billed per workspace