Your accounts and data, protected and yours to take.
This page describes what the software does today. It is not a certification; when an audit or certification exists, it will be listed here with the report.
Signing in
- Passwords are stored only as bcrypt hashes (cost 12), never as text.
- After 5 wrong passwords the account locks for 15 minutes and its owner gets an e-mail.
- A session ends after 24 hours without activity. Logging out ends it on the server at once.
- Settings lists every device that is signed in; you can sign any of them out. Changing the password signs out all other devices.
Connected accounts
- Facebook, Instagram, TikTok and YouTube access tokens are encrypted with AES-256-GCM before they are stored.
- Only workspace admins can connect or disconnect accounts.
- If a platform revokes access, posting to that account stops and you are asked to reconnect. We never ask for your Facebook, TikTok or Google password.
Workspaces and files
- Every workspace is separated: each query is limited to your workspace, and in production the database enforces the same rule with row-level security.
- Photos and videos sit in a private storage bucket. A platform receives a file link only when a post is published.
- All traffic uses HTTPS. Requests are rate-limited to slow down abuse.
- Sign-ins, lockouts, role changes and account connections are recorded in a security log that admins can read.
Payments and AI
- Card, e-wallet and bank details are entered on Midtrans or PayPal and never reach DIGASS Social.
- When you use AI assist, the text or image you give it is sent to Google Gemini to produce the suggestion. Nothing is sent when you do not use it, and suggestions are never posted automatically.
Who can do what
Three roles per workspace. An admin can change anyone's role in Settings, Team.
| Permission | Admin | Editor | Viewer |
|---|---|---|---|
| See content, calendar and analytics | |||
| Write, schedule and publish posts | - | ||
| Upload and organise media | - | ||
| Connect or disconnect platforms | - | - | |
| Invite people and change roles | - | - | |
| Read the security log | - | - |
Your data, on request
In Settings you can download everything stored about you as a JSON file, or delete your account. Deleting removes your drafts, schedules, characters and uploaded files, including the files in storage. If you are the only member, the whole workspace is deleted.
Questions about security: admin@digass.my.id
Create your workspace