Built to pass your security review
PostNow connects to your LinkedIn account and stores your content — so we hold ourselves to the same standard you'd expect from any vendor handling professional data.
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest. Connection strings and secrets live in a managed vault — never in source.
Least-privilege access
Role-based access, scoped API tokens, and time-boxed service credentials. Engineers don't have access they don't need.
Row-level security
Every database query is filtered by owner ID at the database layer. A bug in app code can't accidentally expose another tenant's data.
Audit logs
Every authentication, draft edit, publish event, and admin action is logged and retained for 12 months minimum.
Secure by default
Dependency scanning, SAST, and SBOM generation run on every commit. We patch critical CVEs within 48 hours.
Incident response
A documented 24/7 incident response process with severity tiers, customer notification SLAs, and post-mortems published publicly.
How we handle your LinkedIn account
LinkedIn access is the most sensitive permission we hold. Here's exactly what we do — and don't do — with it.
OAuth 2.0 sign-in only — we never see your password.
Tokens are encrypted at rest with per-tenant keys.
Publishing goes through LinkedIn's official Marketing API endpoints.
You can revoke the connection from your LinkedIn account at any time.
We never scrape, mirror, or store data beyond what the API authorizes.
Compliance status
GDPRCompliant
CCPACompliant
SOC 2 Type IIIn progress — Q1 2027
ISO 27001Roadmap — Q3 2027
HIPAANot applicable
Data residency (EU)Available on Enterprise
What we don't do
Scrape LinkedIn data outside official APIs
Store or access your LinkedIn password
Share your content with other users for training
Sell your personal data to third parties
Specific dates and certifications are updated as audits complete. Contact sales@postnow.io for the latest.
Common questions from security teams
Where is my data stored?+
On managed Postgres and object storage in our primary cloud region (US). Enterprise customers can opt into EU data residency with isolated infrastructure.
Can I get a security review packet?+
Yes. Send a note to security@postnow.io and we'll send our latest SOC 2 readiness report, pen test summary, sub-processor list, and DPA.
How do you handle breach disclosure?+
We commit to notifying affected customers within 72 hours of confirmed incident classification, in line with GDPR requirements.
Do you support SSO and SCIM?+
Yes. Organization SSO uses OpenID Connect — it works with Okta, Entra ID, Google Workspace, and any OIDC-compliant IdP; SAML-only IdPs connect via their OIDC-compatibility tier. SCIM 2.0 user provisioning ships alongside it. Contact sales@postnow.io for setup.
Need our security packet?
Send a note to security@postnow.io and we'll send our latest reports, sub-processor list, and DPA within one business day.