Security Policy

• All traffic is encrypted in transit (TLS).
• Data is encrypted at rest on managed cloud infrastructure.
• Meta access tokens are encrypted with dedicated keys, separate from application data.

• Access tokens are obtained only through Meta's official OAuth flow.
• Tokens are stored server-side, encrypted, and are never sent to the browser or mobile app.
• Only background sync jobs can decrypt tokens, and only to call Meta's approved APIs.
• On disconnect or revocation, tokens are deleted and syncing stops immediately.

• Row-level security restricts every record to its owner (and, where appropriate, an authorized brand or admin).
• Sensitive columns (such as tokens) are isolated from client-readable views.
• Administrative access is role-based, needs two-step sign-in, and is audited. Large payouts need a second approver.

We collect only the profile and aggregate performance data needed to power creator profiles, media kits, and campaign management. We do not collect follower identities, private messages, or other private user data.

We monitor for anomalies and maintain a process to investigate, contain, and remediate security incidents, and to notify affected users and authorities where required by law. Report a vulnerability to security@withcirclex.in.