We guard your accounts like our own.
Watchpost holds the keys that let it publish for you, so security is built in. Here is how we protect your accounts, team and data, in plain language.
- Encrypted platform keys
- Two-factor sign-in
- PDPA and GDPR aware
Our approach
We collect as little as we can, encrypt what matters most, test our own defences and tell you quickly if something goes wrong. Before launch we checked the product against the OWASP ASVS Level 2 security checklist, with every finding fixed and covered by automated tests.
- Collect as little as we can
- Encrypt what matters most
- Test our own defences
- Tell you quickly
How we protect your accounts
Built into Watchpost and checked by automated tests on every change.
Encrypted platform keys
When you connect a channel, the platform gives Watchpost an access key. We never see your social media passwords.
- Access and refresh keys are encrypted at rest, with keys we can rotate
- Keys are never shown in the app, returned by our API or written to logs
- We ask each platform only for the permissions Watchpost needs
- Removing a channel deletes its keys
Strong sign-in
Your Watchpost account is protected with modern sign-in practices.
- Two-factor sign-in with an authenticator app, plus recovery codes
- Passwords of 12+ characters, checked against breached passwords
- Repeated login attempts blocked; an email on any new browser sign-in
- Active sessions with "log out everywhere", and your password asked again before sensitive actions
Roles and separation
People only see and change what their role allows, and workspaces are kept strictly apart.
- Owner, admin, editor and viewer roles with clear permissions
- Only owners, and admins they choose, can manage billing
- Every request checked against your workspace, proven by automated tests
- Approvals so nothing goes out without a manager's yes, if you want it
Superuser-only admin
Our internal admin is separate from the app and open only to named super-administrators.
- A private admin address behind an IP allow-list
- Two-factor sign-in required for every super-administrator
- Support views of a workspace are read-only and logged
- The security log can be read there, never edited or deleted
Security event log
Important security events are recorded so problems can be spotted and investigated.
- Sign-ins, failed sign-ins, two-factor changes and session changes
- Channel connections, disconnections and reconnections
- Email addresses masked in the log, and secrets removed
- Alerts to our team on unusual activity
Rate limits and abuse protection
Limits on every part of the service stop one bad actor from slowing down everyone else.
- Per-user and per-IP limits on every API request
- Bot checks on sign-up without third-party captchas or trackers
- Links you paste are fetched safely and can never reach our private network
- Messages from our payment provider and the platforms are signature-checked, with replay protection
Hardened infrastructure
Our infrastructure is set up to keep attackers out.
- HTTPS everywhere, with strict security headers and a content security policy
- Database and cache on a private network, never exposed to the internet
- Uploaded files checked by content, images re-encoded and location data removed
- Automated code and dependency scanning on every change
Secure card payments
Card payments are handled entirely by a certified payment provider.
- Your card number goes straight to the payment provider and never touches our servers
- Payment messages to us are verified with a signature before we act on them
Your data, your rights
Watchpost is designed around Malaysia's Personal Data Protection Act 2010 (as amended in 2024) and the EU and UK GDPR, wherever you are.
- Your posts, media and analytics are kept together in one place, never shared with advertisers.
- An export is ready to download for 7 days, and only you can download it.
- Account deletion waits 14 days so you can cancel, then it is permanent.
Notice in English and Bahasa Malaysia
Our Privacy Policy is published in both languages, as the PDPA requires.
Export your data yourself
Download your data as JSON plus your uploaded media, from your settings, whenever you like.
Delete your account yourself
Deletion starts a 14-day grace period so you can change your mind, then your data is permanently deleted.
Platform deletion requests
If you remove Watchpost in your Facebook, Instagram or Threads settings and ask for deletion, we delete that data and give you a confirmation code.
Only necessary cookies
Only the cookies that keep you signed in, secure and your settings remembered. No ads, no tracking pixels. Payment pages also use the payment provider's fraud-prevention cookies.
No selling, no secondary use
We never sell your data or use platform data for anything other than running Watchpost for you.
Data processing agreement
Agencies handling client data can rely on our Data Processing Agreement.
Breach readiness
If a breach affects you, we follow a written plan, notify the authorities as the law requires and tell you in plain language.
Built around the laws that protect you
Wherever you are: the PDPA, the GDPR and every platform's developer rules.
Personal Data Protection Act 2010
Malaysia, as amended in 2024
- Privacy notice in English and Bahasa Malaysia
- Consent recorded with version and time; marketing email only if you opt in
- Access requests answered free of charge within 21 days
- A written breach plan built around notifying within 72 hours
EU and UK GDPR
For customers and contacts in Europe
- A Data Processing Agreement for agencies handling client data
- Access, portability and erasure built into the app
- Standard Contractual Clauses for transfers abroad
- Technical and organisational measures listed in the DPA
Platform developer rules
Meta, Google and TikTok
- Only the permissions each feature needs
- Google API Services User Data Policy, including Limited Use
- Meta data deletion and deauthorisation callbacks
- Independent: not affiliated with or endorsed by any platform
Watchpost does not hold ISO 27001 or SOC 2 certification, and we will not claim certifications we do not have. "Designed around" means our features and policies follow these laws; it is not an approval by a regulator.
Found a vulnerability? Tell us.
We welcome reports from security researchers. Please email us privately with the details, and do not test against accounts or data that are not yours.
- AcknowledgementWithin 3 business days
- Triage decisionWithin 10 business days
- Fix for confirmed high or critical issuesAimed within 30 days
- Coordinated disclosureAfter the fix, or 90 days at most
Before you test
- Test only your own accounts, or ones whose owner gave you written permission.
- Never touch other people's data and never disrupt the service.
- We can only authorise testing of systems we control, not the social platforms or our service providers.
- Unsure whether something is allowed? Ask us before you test.
Report a vulnerability
- Include the steps to reproduce, the impact you expect and any proof of concept
- Do not include other people's data, and do not access more data than needed to show the issue
- No denial of service, spam or social engineering
- We credit researchers in our release notes unless you prefer otherwise
Research that follows the policy in good faith is authorised and we will not take legal action over it. We do not pay bounties, but we are grateful for every report.
Security questions
Try it with your own accounts
30 days free on the full plan. No card needed. Security questionnaire? Email support and we will answer honestly.