Trust

Security and Safe Use: 2FA, Permissions, Data and Reporting

Updated October 27, 2026 · Multi Post Social guide

Security in plain words

A social media management tool holds the keys to your public voice. If someone gets into your account, they can post as your brand on every connected network at once. That is why security is not a settings page you visit once; it is a set of habits and controls that work together. Multi Post Social is designed so the safe path is also the easy path: channels connect through each network’s own login, every plan has two-factor authentication, roles limit who can publish, and every sensitive action is written to a log you can read.

We also keep our promises modest. No online service is risk-free, and no tool can make a network account safe if the network password is reused everywhere. What we can do is store as little as possible, protect what we store, make permissions visible, and respond fast and openly when something goes wrong. The rest of this page is the detail behind those four commitments.

Account security: 2FA, sessions and passwords

Two-factor authentication

Two-factor authentication (2FA) is available on every plan, including Free. Turn it on in Settings → Security. You scan a QR code with an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy, enter the first code, and save ten backup codes somewhere safe. From then on, a sign-in from a new device needs your password and a six-digit code. Admins on Team, Agency and Enterprise can require 2FA for every member; members without it are asked to set it up at their next sign-in and cannot publish until they do.

Sessions and devices

Settings → Security lists every signed-in device with its browser, rough location and last activity. You can sign out any device with one click, or sign out everywhere, which also rotates the session tokens so an old link or cookie cannot be reused. Sessions on the web expire after 30 days of inactivity; the mobile apps keep you signed in until you sign out or the password changes. A new sign-in from an unknown device sends an email with a one-click "this was not me" button that ends the session and prompts a password change.

Passwords

Passwords must be at least 8 characters; we recommend 12 or more and a password manager. We check new passwords against lists of leaked passwords and reject known ones. Passwords are stored as salted hashes with a slow algorithm, never in plain text, and nobody at Multi Post Social can read them. Password resets use a one-time link that expires in one hour. We never ask for a password by email, chat or phone. The login guide explains what to do when a code or reset link does not arrive.

For guidance on choosing strong passwords and using 2FA, see the US Cybersecurity and Infrastructure Security Agency’s advice at cisa.gov and the NIST digital identity guidelines at pages.nist.gov.

Connected channels and what tokens allow

When you connect a channel, you leave Multi Post Social for a moment and sign in on the network’s own page: Meta for Instagram and Facebook, LinkedIn, TikTok, Google for YouTube and Business Profile, and so on. The network asks you to approve a list of permissions and then hands us a token. We never see your network password, and we cannot do anything the token does not allow. The token is the only thing stored, and the network can revoke it at any time from its own settings.

Tokens allow three kinds of actions, depending on the network: publish posts and media to the account, read public metrics for the account’s posts, and read and reply to comments, messages and mentions. They do not allow changing your network password, your email, your billing details on the network, or your account’s privacy settings. For Bluesky we use an app password, which is a separate password you create for one app and can delete at any time. For Mastodon the token is scoped to your server and your account.

Good habits: review connected apps inside each network every few months and remove ones you no longer use; reconnect a channel only from the Channels screen inside Multi Post Social, never from a link in an email; and when a team member leaves, remove them from the workspace so their access to every channel ends at once.

What we store and for how long

The rule is to store what the product needs and nothing else. The table below lists each kind of data, why it exists, and when it is deleted. Analytics are kept because history is the point of analytics; inbox items are kept so a conversation can be found later; AI prompts are not kept at all beyond returning a result.

We do not sell data, do not show ads, and do not use your content to train AI models. The privacy policy is the legal version of this table.

Export and deletion

Settings → Data has two buttons. Export builds a file with your posts, ideas, inbox history, analytics, settings and members, with media included as links, and emails you when it is ready. You can run an export as often as you like. Delete account removes your user record and every workspace you own. Posts already published on the networks stay there, because they belong to the network account, not to us. Deletion completes within 30 days; backups age out within a further 30 days. If you own a workspace with other members, you are asked to transfer ownership or confirm that the workspace should be deleted with your account.

Workspace owners can also delete a single workspace, a single channel with its history, or individual posts and inbox items. Deleting a channel removes its token immediately and its data within 30 days.

Encryption and infrastructure

All traffic between your browser or phone and Multi Post Social uses TLS 1.2 or higher; plain HTTP is redirected. Data at rest, including channel tokens, is encrypted with industry-standard algorithms, and tokens are additionally encrypted with keys that are separate from the database. Backups are encrypted and tested by restoring them. Access to production systems needs 2FA, is limited to the engineers who operate the service, and is logged.

The web application sends security headers that block content sniffing and framing by other sites, and the browser extension asks only for the permission to read the page you choose to share. Dependencies are scanned for known vulnerabilities and updated on a schedule. We do not run third-party trackers or advertising scripts on the app or on this website.

Team controls: roles, audit log and SSO

Roles limit damage. An Owner and Admins can change the plan, connect channels and manage members. Editors can publish. Contributors can draft but need approval. Viewers can read analytics and the calendar. Clients can approve from a link without seeing the rest of the workspace. Members can also be restricted to specific channels, so a freelancer who runs one brand never sees the others. The team collaboration guide explains each role in detail.

The audit log in Settings → Security records sign-ins, failed sign-ins, password and 2FA changes, channel connections and disconnections, member invitations and role changes, plan changes and API key creation, with the time, the member and the device. Owners and admins can read it; Enterprise plans can export it to their own systems. Enterprise plans also support single sign-on with SAML, so access can be granted and removed from the company directory.

Platform-policy compliance

Posting through a tool does not change the rules of the networks; it makes following them easier. Each network has terms on frequency, duplicate content, automation, hashtags and the disclosure of paid partnerships. Multi Post Social warns in the composer when text is identical across many channels in a short window, counts hashtags against each network’s limit, offers the network’s own paid-partnership label where the API supports it, and refuses to schedule content types a network does not allow tools to post. Our acceptable use policy adds our own rules: no spam, no automation that breaks network rules, no hateful or illegal content, no impersonation.

You stay responsible for what is published under your name. Read the rules of the networks you use, keep your posts honest, and label advertising. In the United States the Federal Trade Commission’s endorsement guides explain disclosure; many other countries have similar rules.

Phishing and copycat sites

Fake sign-in pages are the most common way social accounts are lost. The real Multi Post Social sign-in page is at multipostsocial.com and nowhere else, and the real mobile apps are the ones listed on the app page. Emails from us come from addresses ending in @multipostsocial.com and never contain a sign-in form or ask for a password, code or card number. If an email asks you to "verify your account" or "update billing" through a link, do not click; open the app directly and check Settings instead.

Signs of a copycat: a domain with an extra word or a different ending, a page that asks for your network password instead of opening the network’s own login, a browser warning about the certificate, and urgency such as "your account will be deleted in 24 hours". Report suspected copies to security@multipostsocial.com with the address of the page; we work with hosting providers and registrars to take them down.

Reporting abuse or a vulnerability

If you find a security weakness in the product, the website, the apps or the API, write to security@multipostsocial.com. Include the steps to reproduce, the affected address and, if you can, a screenshot. We confirm receipt within two business days, keep you informed while we fix the issue, and credit you on the changelog if you wish. Please do not access other people’s data, run denial-of-service tests or publish the issue before a fix is live; we treat good-faith research as welcome.

To report abuse of the platform, such as a workspace sending spam or impersonating someone, use the same address with "Abuse" in the subject. To exercise a privacy right, such as access or deletion, write to privacy@multipostsocial.com. The contact page lists response targets.

How we communicate incidents

If an incident affects your data or your ability to publish, you hear about it from us first. The status page shows the current state of publishing, inbox sync, analytics and the API, and every incident gets a timeline: what happened, who was affected, what we did and what we are changing. For incidents that involve personal data we notify affected customers by email within 72 hours, as the GDPR requires, and give clear steps to take. The full text of the regulation is at gdpr.eu.

Data residency and regulations

Data is stored on major cloud infrastructure with encryption in transit and at rest. Customers under the GDPR or the UK GDPR can request a data processing agreement, and California residents have the rights described in the CCPA, including knowing what is collected and asking for deletion. Enterprise customers can ask for storage in a specific region where our infrastructure supports it. Sub-processors, the services that help us run the product such as hosting, email delivery and payment processing, are listed in the privacy policy and updated when they change.

Security on your phone

The mobile apps use the same account, 2FA and session rules as the web. Add a device lock or biometric lock to the app in its settings so a lost phone does not become a lost brand. Keep the operating system and the app updated; updates often include security fixes. Avoid signing in on shared or public devices, and if you must, use a private browser window and sign out everywhere from Settings → Security afterwards. Push notifications for new sign-ins, failed posts and channel disconnections are the fastest way to notice a problem.