Security
Your accounts are your livelihood. Here is how we protect them, in plain words.
Your platform passwords
We never see them. You sign in on each platform’s own page; access tokens are held by our publishing infrastructure provider, never sent to your browser, and revoked when you disconnect. Bluesky connects with an app password you make for Octoque: it is passed straight to Bluesky and never stored or logged.
Messages, comments and reviews
Read live from each platform when you open them and shown to you; we don’t store them.
Your Octoque password
Stored only as a strong salted hash. Sign-in is rate-limited and takes the same time whether or not an account exists. Deleting your account asks for your password again.
Sessions and API keys
Sessions live in a secure, HTTP-only cookie. API keys can post and read, but can never delete your account, change billing, manage your team or export your data.
Your files
Checked by their real contents (not their name), stored under random names, and served from an isolated address with a strict sandbox, so a disguised file can’t run code.
Team permissions
Owners, admins, managers and contributors each get only what their role needs. Approved posts go back for approval if anyone edits them.
The app itself
Strict browser security rules (content security policy with per-request nonces, HSTS, cross-origin isolation), request size limits, shared rate limits, and automated tests on every change.
Where data lives
Stored in the EU (Frankfurt, Germany), encrypted in transit and at rest with our hosting providers, with backups that roll off within 35 days.
When something goes wrong
We tell affected people without delay and notify regulators within the time the law sets (72 hours in the EU, UK, India and Saudi Arabia). Incidents are listed on this page.
Report a vulnerability
Found a security problem? Email hello@octoque.com with the steps to reproduce it. We reply within 2 business days, keep you updated, and credit you here if you’d like. Please don’t access other people’s data, disrupt the service, or share the problem publicly before we’ve fixed it; research done in good faith under these rules won’t face legal action from us. Our security.txt has the details.
Incidents
No security incidents to report.
More
How we handle personal data is in the Privacy Policy; business customers can rely on our Data Processing Addendum.