Skip to content
Sign inStart free

Security

How we protect business workspaces, sign-ins, connected accounts and content. This page describes practices that are in place today; we do not claim third-party certifications.

Last updated:

Sign-in and access

  • Accounts use Better Auth, an open source authentication library. Passwords are stored only as salted hashes, and you can sign in with Google instead of a password.
  • Authenticator-app two-factor sign-in with backup codes is supported, and woaa.social staff access to the internal control plane can be required to use it.
  • Each workspace is private to its business. Every request is checked against your membership before data is returned.
  • Team access is role based: owners, approvers and contributors each see and do only what their role allows. Only owners and approvers can approve, publish or manage channels.
  • Our support team cannot open your workspace unless an owner approves a time-limited access grant. Every read and edit under that grant is recorded.

Protecting data

  • All traffic to the portal and API uses HTTPS. Cloudflare sits in front of our servers.
  • Access tokens for connected social accounts are encrypted at rest with AES-256-GCM using a key held outside the database, and are never sent to the browser.
  • The temporary state used while connecting an account is also encrypted and expires.
  • Our servers run on dedicated infrastructure in Hetzner data centers. Website reading, document parsing and grammar checking run on services we host ourselves.

Control over what is published

  • Posts never publish without approval from someone with approval rights, and new campaigns start paused.
  • Workspace managers can pause all publishing at once from Settings, Account, Workspace controls.
  • The workspace activity log records changes to Kocco, brand settings, team and content, with who made them and when.
  • Kocco's proposed configuration changes are shown for review before they apply.

Reporting a vulnerability

If you find a security issue, email [email protected] with the subject “Security” and include steps to reproduce. Please do not access, change or delete other businesses' data, and give us a reasonable chance to fix the issue before disclosing it.

Related

See Subprocessors, Privacy Policy and How we use AI.