Security

Encryption

• In transit. All traffic is served over HTTPS/TLS.
• At rest. Data is stored on encrypted infrastructure.
• Connected accounts. The credentials that let us publish on your behalf are encrypted with a separate key, so they stay protected even if a copy of the database were exposed.

Authentication & access

• Passwords are stored only as salted hashes, never in plain text.
• Sessions use secure, HTTP-only cookies with CSRF protection.
• Workspace roles enforce least-privilege access: members only see and do what their role allows.
• We never ask for or store your password to any connected social network. You connect through each network's official sign-in, and you can revoke access at any time.

Infrastructure

• Managed, reputable cloud providers for database, storage, and compute.
• Background jobs run in isolated workers; publishing failures are retried with backoff and surfaced to you.
• Media is stored in object storage with scoped access.
• Least-privilege service credentials and environment isolation.

Payments

Card data is handled entirely by our PCI-compliant payment providers, Razorpay and Polar. Tesselith never sees or stores full card numbers.

Data ownership & deletion

Your content and connected accounts are yours. You can disconnect any channel, which revokes and deletes its stored credentials, and delete your content or account at any time. See our Privacy Policy for retention details.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please email [email protected] with details and steps to reproduce. Please give us a reasonable opportunity to remediate before public disclosure, and do not access or modify data that is not yours. We will not pursue legal action against good-faith research conducted under this policy.

Contact

Security questions? Email [email protected].