Security

Last updated 4 November 2026

Brand Autopilot holds the keys to your social accounts and your unpublished content, so we build it in layers: if one safeguard fails, others are there to catch it. This page describes those safeguards in plain words. It describes how the service is designed; it is not an independent audit or certification.

Your company's data stays separate

Each company is a separate workspace. Besides the app's own checks, the database applies row-level security to every query, so a single mistake in the app is far less likely to show one company's data to another.
The app connects to the database with a limited role that owns no tables and is not allowed to bypass row-level security.
Which company you are working in comes from your signed-in session and a membership check, never from the browser alone.

Signing in

Accounts are created by invitation only; there is no public sign-up.
Passkeys and two-step verification with an authenticator app are supported, and we recommend turning one on.
Passwords are at least 12 characters, stored only as salted hashes, and checked against known breaches without the password ever leaving our servers.
Sign-in attempts are rate limited, and sessions expire after 12 hours.

Connected social accounts

We use only each network's official API and sign-in. We never ask for, or store, your social media passwords.
Access tokens are encrypted with a key that only the publishing service holds, so the web app has no way to decrypt them.
We ask only for the permissions a feature needs, and disconnecting an account deletes its tokens.

AI and untrusted text

Comments, web pages and uploaded documents are given to the AI as quoted material, not as instructions. Posts still go through a person's approval, so text like this does not publish anything on its own.
Nothing is published without a person's approval, apart from automatic comment replies that a company turns on, which run within a daily limit. See AI and automation.

On the web

All traffic is encrypted in transit, and pages are served with a strict Content Security Policy, HSTS and protections against framing.
Uploaded images are served with no scripts allowed, and location and camera details are removed from uploads.
Forms are protected against cross-site requests, and the public contact form is rate limited.

Records and operations

Important actions, such as approvals, role changes and billing, are written to an append-only audit log: the app can add entries but not change or delete them.
Logs leave out anything that looks like a secret.
Changes to the code go through automated checks, including tests and licence checks, before they ship.
Payments are handled by Paystack's checkout, so card numbers are entered with Paystack and not sent to our servers.

What you can do

Turn on a passkey or two-step verification in Security, inside the app.
Give each person the lowest role that lets them do their job, and remove people who leave.
Review connected accounts in Channels from time to time, and disconnect any you no longer use.

Reporting a vulnerability

If you think you have found a security problem, email privacy@utawaziea.com with “Security report” in the subject, and include the steps to reproduce it. Please do not access other people's data, disrupt the service, or share the issue publicly before we have fixed it. We will acknowledge your report and keep you updated while we work on it. Testing beyond this needs our written permission, as our acceptable use policy explains.