Security Practices
ClearCast holds delegated access to the social accounts you connect, so protecting that access is core to the product. This page describes the controls we have in place today. We describe only what is actually true; planned items are listed separately on our Trust Center.
Encryption
- In transit: all traffic to ClearCast is served over HTTPS/TLS.
- At rest: application data and uploaded media are stored on managed infrastructure (Supabase, running on AWS) that encrypts data at rest.
Protecting connected-account tokens
- OAuth access and refresh tokens for your connected platforms (Facebook, Instagram, YouTube, X, Mastodon) are stored server-side only.
- A response filter strips credential material from every API response, so tokens are never sent to the browser or exposed to other customers.
- You can revoke ClearCast's access at any time by disconnecting a platform in Settings → Integrations, which deletes the stored tokens.
Tenant isolation
Every API request is scoped to the authenticated user and their workspace. Access to another customer's posts, media, analytics, or connected-account tokens is not possible through the application. We verify this isolation as part of our development process.
Payments
Billing is processed by Stripe, a PCI-DSS Level 1 service provider. ClearCast never receives or stores full payment-card numbers.
Privacy by default
ClearCast uses a single essential, first-party session cookie and no third-party advertising or analytics trackers. We do not sell or share personal information, so there is nothing to opt out of. See our Cookie Policy.
Access & operations
- Administrative functions are permission-gated and limited to authorized accounts.
- Application secrets and platform credentials are held as environment configuration, not in source code.
- Sensitive actions are recorded in a per-workspace activity log.
Reporting a vulnerability
If you believe you've found a security issue, please see our Responsible Disclosure policy or email security@clear-cast.net. We support good-faith research and will not pursue researchers who follow that policy.