Authentication and access
- Users sign in with email/password or approved OAuth accounts.
- Passwords are hashed with scrypt and a per-password salt.
- Session tokens are random, stored hashed at rest, and sent in HTTP-only cookies.
- Pending, disabled, and deleted users are blocked from the authenticated tools.
- Access checks keep each self-serve account within its own workspace and data.
Database security
The Easy Social runtime uses restricted Postgres credentials with tenant context and row-level security. Database access in the app uses parameterised queries rather than string-concatenated SQL.
User data and uploads
- Generated PDFs, images, uploads, and audit archives are stored outside the source tree in configured data directories.
- Document downloads are authenticated. Public upload serving blocks confidential document paths and inspection report paths.
- Upload handlers enforce file type checks, signature checks, and size limits for image and PDF flows that use the shared upload helpers.
- Time-limited reel download links use unguessable tokens, and public endpoints are rate-limited where they accept state changes.
Payments
Payments use Stripe-hosted Checkout and Billing Portal, so card data goes directly to Stripe. Stripe webhook signatures are verified before subscription state changes are accepted. Webhook event IDs are recorded before subscription side effects, duplicate deliveries are skipped, and operational handler failures return an error to Stripe so Stripe can retry rather than silently losing payment-state events.
API protection and rate limiting
Authenticated APIs check the current session and account on the server. Public and high-cost endpoints use rate limits, including login, signup, password reset, OAuth callbacks, map proxies, listing imports, AI content generation, property reels, and Social Tiles generation.
Backups and operations
Backup scripts and backup storage paths are part of the platform. Offsite encrypted backup status and restore evidence should be verified before making stronger disaster-recovery commitments in procurement material.
Compliance status
- Easy Social is built to align with the New Zealand Privacy Act 2020.
- Card payment handling relies on Stripe's PCI-DSS compliant hosted payment flow.
- Easy Social has not completed SOC 2 or ISO 27001 certification.
- Easy Social has not completed a third-party penetration test unless separately stated in a signed client document.
Report a vulnerability
Email [email protected] with enough detail to reproduce the issue. Please do not publicly disclose a vulnerability before it has been investigated and remediated.