What we hold,
and how.
Connecting a Facebook Page to a piece of software means handing it the ability to speak as your business. That deserves a straight description of the controls, and an equally straight list of what does not exist yet.
Built in
Tenant isolation is server-side
Every customer row belongs to a workspace, and every read takes that workspace as a required argument — a query that forgets the tenant does not compile. Authorization is enforced on the server and fails closed, so knowing an object's ID is not enough to read it.
Provider tokens never reach a browser
OAuth tokens are encrypted at rest, redacted from logs, and never serialised into a page. The browser talks to us; we talk to Meta and Google.
Sessions are revocable immediately
An opaque token in an httpOnly cookie, stored only as a hash, with a rolling idle window and a hard ceiling. A password change or a “sign out everywhere” takes effect on the next request, not when a JWT happens to expire.
Webhooks are verified before they are parsed
Signatures are checked against the raw request bytes. Provider event IDs are stored and replays are rejected idempotently.
Every privileged action is audited
Support access states who, why, for how long, and against which workspace. Impersonation shows a persistent banner and grants no writes unless specifically permitted.
Uploads are quarantined first
Files land in a quarantine prefix, are scanned and probed, and only then move to the safe prefix and get renditions.
What we do not claim
No security certification. Scalematics has not completed a SOC 2, an ISO 27001, or any equivalent audit. If you see a badge for one on this site, it is a bug — tell us.
No customers to reference. There are no case studies, logos, uptime figures or usage numbers anywhere on this site, because there is nothing honest to put in them yet.
No training on your content. The default is that customer content is never used to train shared models. Changing that would be a visible policy change, announced, not a quiet edit to a subclause.
On the way
- Multi-factor authentication — the data model is in place; enrolment ships before public launch.
- Postgres row-level security as a second layer beneath the application checks. Not enabled yet: it needs a per-request session variable, which is a footgun on a shared connection pool and deserves its own pass rather than a rushed one.
- A published subprocessor list, once the provider set is final.
- A documented restore drill with a stated RPO and RTO, exercised rather than asserted.
- A security disclosure address and response commitment.
Found something wrong?
Report it before you publish it and we will fix it, credit you if you want the credit, and tell you what the fix was.
Report an issue