Plan Poster
Plan Poster
HomeGo to App
Enterprise-Grade Protection

Security & Trust Architecture

Comprehensive overview of Plan Poster's multi-layered defense: 256-bit AES encryption, Row-Level Security, automated token isolation, and continuous monitoring.

Security Whitepaper • Updated November 2026
AES-256 Encryption
All stored OAuth credentials, tokens, and database records encrypted at rest.
PostgreSQL RLS
Multi-tenant Row-Level Security guarantees strict cross-account isolation.
TLS 1.3 in Transit
Strict HTTPS with HSTS and automated certificate rotation on edge.
01

Cloud Infrastructure & Edge Delivery

Summary in Plain English:Plan Poster runs on globally distributed, SOC-2 compliant serverless cloud networks provided by Vercel and Supabase. There are no single points of failure.

Plan Poster employs a decentralized modern cloud architecture designed for high availability and zero unauthorized ingress:

  • Edge Runtime: Application entrypoints and API routes execute on Vercel's global serverless network, providing automatic DDoS mitigation and instantaneous failover.
  • Database Cluster: Dedicated PostgreSQL managed by Supabase, featuring automated replication, connection pooling, and continuous health auditing.
  • Isolated Background Workers: Cron scheduler tasks run in dedicated isolated sandboxes, checking queue timestamps without exposing database credentials to public traffic.
02

Multi-Tenant Row-Level Security (RLS)

Summary in Plain English:Even though many agencies and creators use Plan Poster, your database records are mathematically locked to your workspace. No other user can ever view or query your channels or posts.

Unlike legacy applications that rely only on application-level filtering, Plan Poster enforces authorization directly at the database engine level via PostgreSQL Row-Level Security (RLS) policies.

CREATE POLICY workspace_isolation_policy ON scheduled_posts
  FOR ALL USING (auth.uid() = user_id OR workspace_id = current_setting('app.current_workspace_id'));

Every database query includes cryptographic session tokens validating workspace ownership before any records are returned.

03

OAuth 2.0 Credential Hygiene & Token Shielding

Summary in Plain English:We never store your social media passwords. We use official OAuth 2.0 tokens that are encrypted and stored server-side. They are never sent to the browser.

When connecting YouTube, Facebook, Instagram, X, or LinkedIn:

  • Zero Password Access: You authenticate directly on the provider's official login dialog (e.g. Google or Facebook); Plan Poster never receives or touches your social password.
  • Encrypted Vault: Access tokens and refresh tokens are stored in encrypted columns with AES-256 Galois/Counter Mode (GCM).
  • Client Token Shielding: Raw access tokens are never transmitted to the browser client. The frontend receives only sanitized channel profiles (e.g. channel name, avatar, account ID).
  • Instant Revocation: Disconnecting a channel from Plan Poster immediately deletes the token from our database and invalidates the session.
04

Authentication & Session Defense

Plan Poster safeguards user sessions through:

  • Secure Cookie Flags: Session tokens use HttpOnly, Secure, and SameSite=Lax cookies to prevent cross-site scripting (XSS) and CSRF attacks.
  • Brute Force Throttling: API rate limiting protects login and registration endpoints against dictionary and automated credential stuffing attacks.
  • Owner Multi-Factor Authentication (MFA): Administrative and super-owner dashboard operations require secondary hardware or TOTP authentication.
05

Backups & Business Continuity

Our database cluster performs continuous Write-Ahead Log (WAL) archiving with point-in-time recovery (PITR) up to 7 days, supplemented by automated daily encrypted snapshots stored in geographically redundant cloud storage. Recovery Time Objective (RTO) is under 1 hour, and Recovery Point Objective (RPO) is under 5 minutes.

06

Responsible Vulnerability Disclosure

Found a potential security issue?We deeply appreciate independent security researchers. Please review our disclosure guidelines below and report findings directly to our security team.

If you believe you have discovered a security vulnerability in Plan Poster:

  • Email details to planposter.team@gmail.com.
  • Do not publicly disclose, alter, or access data belonging to other users.
  • Provide reproduction steps and proof-of-concept payloads.
  • Our engineering team will acknowledge reports within 24 hours and provide continuous remediation status.

Have questions about Plan Poster's policies or compliance?

Our legal, security, and developer teams respond promptly to data rights requests, API usage questions, and platform verification audits.

Contact Legal TeamUser Data Deletion