Skip to content
New: schedule straight from DaVinci Resolve with the Reelport plugin →
reelport.io
Start free trial

Security

Last updated 7 November 2026

reelport.io holds the keys to your social channels, so we keep the list of what we do short and true. This page describes the service as it is built today.

In transit

All traffic to reelport.io is encrypted with TLS, and the calls reelport.io makes to Instagram, Facebook, TikTok, YouTube, Stripe and Postmark use HTTPS. Stripe’s webhooks are only accepted with a valid signature.

Channel logins

  • You sign in to Meta, TikTok and Google on their own pages; reelport.io never sees those passwords.
  • The access and refresh tokens we receive are encrypted in the database (AES-256) and are only decrypted to publish or refresh.
  • Disconnecting a channel deletes its tokens immediately; see data deletion.

API tokens and device sign-in

  • Personal API tokens are shown once and stored only as SHA-256 hashes, so a copy of our database would not reveal them.
  • Each token is limited to one team and to the abilities you tick (channels:read, media:write, posts:read, posts:write, brand:read, brand:write), and can be revoked at any time.
  • The Resolve plugin and Claude sign in with a device code (RFC 8628): no password is entered in them, device codes are stored hashed, live 15 minutes and can be used once.
  • The API is rate limited per token: 120 requests a minute and 60 uploads an hour.

Signing in to reelport.io

  • Passwords are stored only as salted hashes.
  • Two-factor authentication with an authenticator app, with recovery codes; two-factor secrets are encrypted.
  • Passkeys (WebAuthn) as an alternative to passwords.
  • Login attempts are limited to five a minute per email address and IP.

Teams and access

Every channel, file and post belongs to a team, and every request is checked against the team you are a member of. Inside a team, roles separate what owners, admins and members can do; only owners manage billing and members. Only Pixel & Process staff who need it for support or operations can reach production systems.

Hosting and media

  • The application and database run on Hetzner servers in the EU; media is stored on Hetzner Object Storage in Helsinki, Finland.
  • The media bucket is private. Platforms receive either the file itself or a signed link that expires after one hour.
  • Media files are deleted automatically 30 days after their last post.
  • The full list of service providers is on the subprocessors page.

Backups

The database is backed up on Hetzner servers in the EU. TODO: confirm backup frequency, retention and encryption

Reporting a vulnerability

If you find a security problem, please tell us before telling anyone else, and give us a reasonable time to fix it. Write to info@pixelandprocess.deTODO: confirm a dedicated security address with the steps to reproduce it. Please don’t access other people’s data, degrade the service or post to accounts that aren’t yours while testing. We will confirm receipt and keep you posted on the fix.