Skip to main content

​
Encryption at rest

Provider OAuth tokens, webhook secrets, and stored credentials are encrypted at rest with AES-256-GCM using ENCRYPTION_KEY. A legacy deterministic mode (AES-256-CBC) is used for the historical organization API key lookups. Losing ENCRYPTION_KEY means stored credentials can no longer be decrypted - keep it backed up with the databases. Data in transit is protected by TLS, terminated at your reverse proxy on self-hosted instances and at the PostSider edge on Cloud.

​
Media retention

Uploaded media older than the retention window is removed by a background cleanup workflow. The default is 90 days, configurable with MEDIA_RETENTION_DAYS on self-hosted instances. The cleanup skips profile pictures, OAuth-app pictures, and media referenced by posts still in the queue. You can review retention and storage usage in Settings → Storage, where the retention window and orphan-media cleanup can be adjusted.

​
Account and organization deletion

An Owner can delete the organization from Settings → Security (type-to-confirm). Deletion:
  • Removes the organization’s channels, posts, media records, API keys, credentials, and subscription;
  • Cancels an active Polar subscription (best-effort, never blocks the deletion);
  • Does not remove uploaded object-storage files from your MinIO/R2 bucket;
  • Does not reset the trial - a deleted and recreated account with the same email does not receive a new trial.

​
Platform compliance callbacks

PostSider implements Meta’s data-deletion and de-authorization callbacks for Facebook, Instagram, and Threads. Meta-verified requests wipe or de-authorize the platform user’s channels across organizations and return a deterministic confirmation code. The landing page is served from DATA_DELETION_URL (Cloud: https://postsider.com/data-deletion).

​
Privacy policy

PostSider’s data handling is described in the Privacy Policy and Terms of Service.