Security and how your data is handled

Signing in to your networks

• No passwords. Each account is connected on the network's own sign-in page (Google, Meta, LinkedIn and the rest) and you approve the access there. We never see or store your passwords.
• Tokens are encrypted before they are stored, bound to your business and the connection they belong to, and only decrypted for the single request that needs them. Every use is logged.
• Each business is walled off twice: by the application, and again by the database's row-level security, so one business's data cannot be read through another's session.
• Disconnect any account at any time; for Google and YouTube we also revoke the access at Google.

When an AI assistant is connected

• You approve the connection on our consent screen and choose what it may do. Access is split into scopes — reading, drafting replies, publishing replies, drafting posts, publishing posts, managing accounts — and a connection can be read-only or draft-only.
• Limits per connection and per person: the owner can restrict an assistant to some client businesses and switch individual tools off. Ids outside its reach answer "not found", the same as ids that do not exist.
• Nothing public without a preview. Publishing, scheduling, editing, deleting, replying and hiding all return a preview first — every account with its label, the exact text, the local time — and act only on a second call carrying a signed approval token that expires after 15 minutes and matches exactly what you saw.
• Retries cannot double-post: a repeated request with the same key returns the first result and sends nothing new.
• Review text is treated as data. A review that says "ignore your instructions" is a review to answer, never an instruction; the server never copies review text into its own hints.
• Less customer data to AI providers: reviewer names go to an assistant shortened ("Jay W.") by default; the owner can choose strict (no names, locations by city only) or full names.
• Brakes: 40 posts and replies a day through a connected assistant; the same text is not posted twice to the same account within 24 hours; review replies paced per location.

Audit log

Every change an assistant makes is recorded once, append-only: who, which app, which accounts, when, a fingerprint (SHA-256) of the content and the network's ids for what it published. Connecting, disconnecting and hiding accounts are recorded too. Owners and admins can export the log as CSV, and send it to their own systems through a signed webhook.

Your data

• See the privacy policy for what we store and why, and data deletion for how to remove everything.
• Review counts are kept as a copy that is refreshed about every 15 minutes while you use them, and deleted 7 days after it was last needed; review reply drafts are kept for 30 days.
• We do not sell data and we do not use your posts or reviews to train AI models.

Reporting a problem

Found a security issue? Email hello@socialforshops.com with "security" in the subject. Changes to how this works are dated in the changelog; the AI connector itself is described on the connector page.