Built to be trusted with your accounts.
Connecting your social accounts is a big ask. Here's how PostLoop looks after them, and your posts, in plain words.
Your sign-ins, sealed
Every network account you connect is encrypted before it's stored, with a key for each workspace. It's never logged, and never shown again.
Your workspace, kept apart
The database itself keeps each workspace's posts, channels and media separate, so one workspace can never read another's.
Posts sent exactly once
A post is claimed before it's sent and checked before any retry, so a glitch never posts twice, and a failure is never silent.
Safe with links you share
When PostLoop fetches a link or a feed you give it, it refuses private and internal addresses, so it can't be used to reach places it shouldn't.
Access you control
API tokens do only what you allow and expire when you choose. Agents work under the same rules as people, with approval if you want it.
Open for anyone to check
PostLoop's code is public. You don't have to take our word for any of this: you can read exactly how it works.
Under the hood
The detail, for developers and security teams.
Encryption
Envelope encryption for every token
Each workspace has its own 256-bit data key, wrapped by a master key kept outside the database. Tokens are sealed with AES-256-GCM, bound to their workspace and channel. Rotating the master key re-wraps the data keys; tokens only exist unencrypted in memory, while a post is being sent.
Isolation
Row-level security in Postgres
The app's database role can't bypass row-level security. Every request runs inside a transaction scoped to one workspace, and tests check that one workspace can't see another's data. Sign-in uses a separate role that can't read posts or credentials.
Publishing
Claim before send, verify before retry
Each send is claimed in a transaction first. If the outcome is unknown, PostLoop looks for the post on the network before trying again. Property tests throw random crashes, timeouts and rate limits at it to check a post never goes out more than once.
Outbound requests
One guarded path to the internet
Anything PostLoop fetches because of what a user entered (links, feeds, media) goes through one client that allows only http and https, blocks private, loopback and cloud-metadata addresses, re-checks every redirect, and caps size and time.
API and webhooks
Scoped tokens and signed deliveries
API tokens carry only the scopes you pick, with an expiry and per-token rate limits; every change accepts an idempotency key. Webhooks are signed with HMAC-SHA256 and a timestamp, with a replay window, retries and a dead-letter queue.
Secrets
Nothing secret in the code
Keys and passwords live in environment settings or a secrets store, never in the repository, and network tokens never appear in logs or API responses.
You choose where your data lives.
Self-hosted
Run PostLoop on your own server. Your posts, media and sign-ins never leave it, and you connect networks with your own developer apps and AI key.
How to self-hostPostLoop Cloud
We run it for you on Cloudflare's network, with the same encryption and workspace isolation as the open-source edition.
See plansFound a security issue?
Please tell us privately through GitHub's security advisories rather than a public issue, so we can fix it before it's shared. We'll reply as soon as we can.
Post with peace of mind.
Start free, or run it yourself and keep everything on your own server.