Security at Voxpanda

Voxpanda encrypts every platform token, separates each workspace’s data inside the database, and deletes a workspace’s data within 30 days of deletion. An AI social media manager holds access to your social accounts, so the controls below start with those tokens. They reflect the internal security review of 14 October 2026.

Connected account tokens

• OAuth tokens are encrypted with AES-256-GCM in the application. The key is kept in a system credential file, not in the database or in environment files.
• Each token records which key sealed it, so keys can be rotated.
• The browser never holds a platform token. The app session uses an httpOnly cookie.
• Tokens that expire within 2 hours are refreshed every hour. If a refresh fails, the channel is marked for reconnection and the owner gets a reconnect link from a Voxpanda WhatsApp number.

Workspace isolation

• Every customer table in PostgreSQL uses row-level security, so a query returns only rows of the workspace that made it.
• An automated test fails if a new table is added without row-level security.
• In the review, one workspace saw zero rows of another workspace across 25 tables, and 8 API endpoints returned “not found” for another workspace’s objects.
• Knowledge base search is locked to one brand inside a database function, and a two-brand test checks that no content from the other brand is returned.

The same per-brand lock keeps AI replies to comments and DMs limited to your own sources.

Requests, forms and uploads

• SSRF protection. When Voxpanda reads a brand website or knowledge base page, it accepts only http and https on ports 80 and 443, checks that every resolved address is public, checks each redirect again, and rejects URLs that contain credentials.
• The background worker that fetches those pages is blocked by the operating system from private networks, link-local addresses and cloud metadata addresses.
• The signup form uses Turnstile bot protection, and requests are rate limited.
• Webhooks from platforms and payment providers are verified by signature before processing. Payment status is read again from the provider.
• Uploads are checked by their first bytes. Only JPEG, PNG and WebP are accepted. SVG and HTML are rejected.
• All traffic to the web app, API and webhooks uses TLS.

Backups

• The database is backed up every day, encrypted. Copies roll over: 14 daily and 8 weekly.
• A restore test runs every week. The latest backup is decrypted, restored to a temporary database, and its row counts are compared.
• A second encrypted copy is kept off the main server.

Export, retention and deletion

• You can export and delete your data in the app during the subscription.
• Deleting a workspace deletes all brand data within 30 days, including stored files. Encrypted backups are overwritten as they expire, about 8 weeks later.
• Integration logs are kept for 90 days. Messages are kept for 365 days by default, and each workspace can choose 90 to 730 days.

The steps for customers and for members of the public are in the data deletion instructions.

Platform rules

• Meta deauthorization and data deletion callbacks are supported for Facebook, Instagram and Threads.
• On LinkedIn, comments and messages from people who are not Voxpanda users are never AI input, so LinkedIn is used for publishing only.
• AI replies on X stay locked until X gives written approval.
• Each brand can label DMs answered by AI. The label is on by default for senders in the EU.

Each platform’s limits are listed in the social media API limits guide.

Subprocessors

The companies that process data for Voxpanda, their purpose and their location are listed in Annex 3 of the data processing agreement. Customer data is not used to train general AI models.

Report a security issue

Email support@voxpanda.com with the steps to reproduce the issue.