Authentication and access
- You sign in with Google or with a single-use sign-in link sent to your email address. Easy Social accounts have no passwords.
- Session tokens are random, stored hashed at rest, and sent in HTTP-only cookies.
- Pending, disabled, and deleted users are blocked from the authenticated tools.
- Access checks keep each self-serve account within its own workspace and data.
Database security
Easy Social connects to its Postgres database with restricted credentials, and row-level security limits each request to the data of the account making it. Database queries are parameterised rather than built by joining strings of SQL.
User data and uploads
- Uploaded files and generated outputs are stored on the Easy Social server, separately from the application's code.
- Brand, profile, team, and campaign images you upload can be fetched by anyone who has their web address, because they appear in the marketing you publish. Other uploaded files are not served publicly.
- Upload handlers enforce file type checks, signature checks, and size limits for image and PDF flows that use the shared upload helpers.
- Time-limited reel download links use unguessable tokens, and public endpoints are rate-limited where they accept state changes.
Payments
Payments use Stripe-hosted Checkout and Billing Portal, so card data goes directly to Stripe. Stripe webhook signatures are verified before subscription state changes are accepted. Webhook event IDs are recorded before subscription side effects, duplicate deliveries are skipped, and operational handler failures return an error to Stripe so Stripe can retry rather than silently losing payment-state events.
API protection and rate limiting
Authenticated APIs check the current session and account on the server. Public and high-cost endpoints use rate limits, including login, signup, password reset, OAuth callbacks, map proxies, listing imports, AI content generation, property reels, and Social Tiles generation.
Backups and operations
Easy Social runs on a virtual server provided by Hostinger in Kuala Lumpur, Malaysia. Each night an encrypted backup of the Easy Social database and stored files is taken on the hosting server, and each day a copy is transferred to a separate encrypted backup store in New Zealand. Backups are kept on a rolling schedule of up to about 12 months and are then deleted.
Compliance status
- Easy Social is built to align with the New Zealand Privacy Act 2020.
- Card payment handling relies on Stripe's PCI-DSS compliant hosted payment flow.
- Easy Social has not completed SOC 2 or ISO 27001 certification.
- Easy Social has not completed a third-party penetration test.
Report a vulnerability
Email hello@airea.co.nz with enough detail to reproduce the issue. Please do not publicly disclose a vulnerability before it has been investigated and remediated.