Security

Encryption

• In transit — all traffic is served over HTTPS/TLS.
• At rest — data is stored on encrypted infrastructure.
• Connected-account tokens — the access tokens that let us publish on your behalf are encrypted with a dedicated application key, separate from the database, so a database snapshot alone cannot be used to impersonate your accounts.

Authentication & access

• Passwords are stored only as salted, hashed values — never in plaintext.
• Sessions use secure, HTTP-only cookies with CSRF protection.
• Workspace roles enforce least-privilege access: members only see and do what their role allows.
• We never ask for or store your password to any connected social network — access is granted through each platform's official OAuth flow, and you can revoke it at any time.

Infrastructure

• Managed, reputable cloud providers for database, storage, and compute.
• Background jobs run in isolated workers; publishing failures are retried with backoff and surfaced to you.
• Media is stored in object storage with scoped access.
• Least-privilege service credentials and environment isolation.

Payments

Card data is handled entirely by our PCI-compliant payment provider, Razorpay. Tesselith never sees or stores full card numbers.

Data ownership & deletion

Your content and connected accounts are yours. You can disconnect any channel — which revokes and deletes its stored tokens — and delete your content or account at any time. See our Privacy Policy for retention details.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please email [email protected] with details and steps to reproduce. Please give us a reasonable opportunity to remediate before public disclosure, and do not access or modify data that is not yours. We will not pursue legal action against good-faith research conducted under this policy.

Contact

Security questions? Email [email protected].