Security

These are the controls CreatorHQ has in place today.

Token handling

• OAuth access and refresh tokens are encrypted with AES-256-GCM before storage.
• The encryption key lives only in the server environment and is never bundled into the browser.
• Tokens are decrypted only inside server code that performs a publish, refresh or validation call.
• No token, client secret or service key is ever returned to the frontend.

Workspace isolation

• Every table has row-level security, scoped to the workspace of the signed-in user.
• Stored credentials are readable only by privileged server code, never by any client session.
• Ownership is re-validated server-side on every publish, retry and delete.

Media storage

• Uploads go to a private bucket with per-user path policies.
• Playback and platform uploads use short-lived signed URLs.

Deletion

• Disconnecting an account revokes the token with the platform where supported, then deletes it.
• Deleting your account removes profile, media, posts, history and credentials.

Reporting a vulnerability

Email support@cliquestudio.online with steps to reproduce. Please do not test against other people's workspaces.