Trust Center

Infrastructure

• Hosted on Amazon Web Services in the United States (us-east-2, Ohio).
• Data in transit is encrypted with TLS 1.2 or higher.
• Stored files and the database disk are encrypted at rest (AES-256).
• Credentials for the social accounts you connect are additionally encrypted before they are stored.
• File storage blocks all public access. Your files are reachable only through short-lived signed links.
• Servers reach storage through a narrowly scoped AWS role — no long-lived access keys are stored on them.

Account security

• Passwords are hashed with bcrypt; we cannot read or recover them.
• Two-step verification for every account: an authenticator app, an emailed code or an SMS code.
• Sign-ins from a new device are verified with an emailed code. A device is recognised only by a random token we issued to it, never by anything a browser can copy.
• Repeated failed sign-ins are slowed down per account and per network address.
• Changing your sign-in email, recovery email or deleting your account requires your current password.

Our own access

• Staff access is role-based: each role reaches only the tools it needs.
• Every staff account must use two-step verification to reach any staff tool.
• Staff actions — role changes, plan changes, refunds, broadcasts — are recorded in an audit log.

Your data

• We do not sell your data, and we do not use it to build advertising profiles.
• You choose what is published and where. Nothing is posted to a connected account without your action or your schedule.
• Disconnecting an account deletes its stored credential and the statistics we synced from it.
• Deleted files are permanently removed from storage within 7 days.
• Database backups run nightly, are kept for at most 7 days, and a full restore is tested every week.
• You can export your data or delete your account from your settings at any time.

Reliability

• If the server or the hardware under it stops responding, it is automatically restarted or moved to healthy hardware, and our team is alerted.
• Scheduled posts that hit a temporary platform outage are retried automatically. A post whose outcome is uncertain is never re-sent blindly, so it is not posted twice.

Compliance status

Clepora is built to support the rights GDPR and CCPA give you — access, export, correction and deletion — and we offer them to every user wherever they live. Clepora has not yet completed a third-party security audit such as SOC 2 or ISO 27001; we will say so here when that changes.

Documents

• Data Processing Agreement — for customers who need one under GDPR or similar law
• Subprocessors — who processes data on our behalf, and where
• Privacy Policy
• Terms of Service
• Data deletion

Report a security issue

Email legal@clepora.com (also published in our security.txt). We acknowledge reports and fix confirmed issues promptly. If a security incident affects your data, we will tell you without undue delay.