Search around and you'll find plenty of vendors in this space waving "enterprise-grade security" without saying what that means. This page does the opposite: a specific, sourced list of what PostGate has built, and an equally specific list of the formal certifications it does not currently hold. We'd rather you know exactly where PostGate stands than assume something we haven't earned. The full legal text lives in the Privacy Policy; this page is a plain-language summary of it.
Every item below is drawn directly from PostGate's Privacy Policy and Data Processing Addendum — quoted in plain language, not marketing copy.
Every social platform credential (Meta, TikTok, LinkedIn, Pinterest, and the rest) is envelope-encrypted at rest and decrypted only by the delivery workers that need it. Token values are never written to logs — not in request logs, not in error traces.
Access to the API and dashboard is protected in transit with TLS. There is no unencrypted path between your client, PostGate, and the social platforms it talks to.
PostGate is a multi-tenant system by design, and tenant data is isolated at the database layer using row-level security — not application-level filtering alone.
Data processing runs on documented legal bases — performance of contract, legitimate interest in securing and improving the service, and consent where required — under both the EU's GDPR and Brazil's LGPD. PostGate acts as processor for the content and social account data you ask it to handle, and as controller for your account, billing, and service telemetry data.
Access to platform credentials and tenant data is scoped and audited. Audit logs are retained for as long as a workspace exists, and infrastructure subprocessors — hosting, identity, billing, email, monitoring — operate under contractual confidentiality and security obligations.
Workspace owners can download a machine-readable export at any time and permanently delete an entire workspace — profiles, encrypted tokens, content, media, and logs — from Account settings. See the Data Deletion instructions for specifics, including the automated Meta data-deletion callback PostGate implements for Facebook, Instagram, and Threads.
PostGate does not currently hold a SOC 2 (Type I or Type II) or ISO 27001 certification, and it does not currently offer a formal, contractual EU data-residency guarantee. We'd rather say that outright than let "enterprise-grade" language imply something PostGate hasn't earned — a false certification claim is exactly the kind of thing that erodes trust once discovered, and it's not one we're willing to make.
What that means in practice: PostGate's Privacy Policy states that data may be processed in regions outside your own using recognized safeguards — there is no dedicated EU-only hosting region on offer today. If a formal SOC 2 report, ISO 27001 certification, or contractual data-residency commitment is a hard requirement for your organization, PostGate is not yet the right fit — and we'd rather you know that now than after signing up.
If your team has a specific compliance question not answered here — a security questionnaire, a request for a current subprocessor list, or a DPA to review — email [email protected] and we'll answer directly rather than with a generic trust page.
| Document | What it covers |
|---|---|
| Privacy Policy | What data PostGate processes, why, who it's shared with, retention windows, and your rights under the GDPR/LGPD. |
| Data Processing Addendum | Controller/processor roles, security measures, subprocessors, and deletion/export terms for organizations that need a DPA. |
| Data Deletion instructions | Step-by-step: disconnecting a profile, revoking Google/YouTube access, and permanently deleting a workspace. |
| Terms of Service | The agreement governing use of the service, including third-party platform terms that continue to apply. |
Start on the free sandbox plan — no card required — or talk to us first.
