Trust
Security built around accountable work
WhoPosts treats organization boundaries, permissions, private media and durable history as product requirements—not optional settings.
Identity and authorization
Email-code authentication establishes identity; active workspace membership, role, store scope and current server-side policy determine access. The client never grants itself a role, store, billing action or review decision. Sensitive operations use revision checks, idempotency and recorded reasons.
Tenant and data boundaries
Database row-level security and narrow server commands isolate organizations. Private originals, previews, evidence and reports use restricted object storage and short-lived, version-pinned access. Exact originals remain separate from previews and annotations, and historical versions are not silently replaced.
Processing and resilience
Uploads are reserved, validated and scanned through bounded jobs before release. Notification, processing and backup workloads are not always-on customer-facing servers. Encrypted database backup tooling and independent immutable-media manifests support recovery verification.
Monitoring and privacy
Operational telemetry is deliberately bounded and redacted. Sentry is configured without replay, screenshots, tracing or customer-content fields. Product analytics uses a fixed anonymous schema rather than autocapture. Public-site Google Analytics loads only after consent.
Responsible reporting
Do not test against production or access another customer’s data. Report suspected vulnerabilities privately to support@whoposts.com, including steps to reproduce and potential impact. We will acknowledge and triage good-faith reports. This page is a security overview, not a certification or guarantee.