Security
Your accounts, your tokens, your content: protected by design
Viralix holds the keys to your social accounts, so protecting them is the part of the product we take most seriously. This page describes what we do today, including what we have not built yet.
Accounts and sign-in
- Passwords are hashed with Argon2id and are never stored or logged in readable form
- New passwords are checked against known breached-password lists without sending the password itself
- Email addresses are verified with a one-time code
- Sign-in, sign-up and reset requests are rate limited
- Sessions use secure, HttpOnly cookies with a 12-hour idle limit, and requests that change data are protected against cross-site request forgery
Platform tokens
- Tokens that let Viralix act on your Facebook, Instagram, YouTube and TikTok accounts are encrypted at rest with envelope encryption (AES-256-GCM)
- The key that protects them is held outside the database
- Tokens are never shown in the app and never written to logs
- We ask each platform only for the permissions a feature needs
Access and tenant isolation
- Every database query is scoped to your organisation and workspace; a request for another customer’s data is answered as if it did not exist
- Role-based permissions decide who can draft, approve, reply, view analytics or manage members
- Workspace actions are recorded in an activity log
- Approval links in emails are signed, single-use and expire
Data and uploads
- All traffic to Viralix uses HTTPS with certificates that renew automatically
- Uploads go directly to private object storage with short-lived signed URLs, and file types are checked before use
- Webhooks from Meta and TikTok are verified by signature before anything is processed
- Retention limits are enforced: for example automation logs are kept 30 days and raw webhook events 7 days
Infrastructure
- Application servers run on Oracle Cloud Infrastructure behind an HTTPS reverse proxy
- The database is a managed PostgreSQL service from Supabase
- Media is stored in Cloudflare R2 object storage
- Our providers are listed on the sub-processors page
Honest about what is not here yet
Planned, not promised
Two-factor sign-in is planned but not available yet, so use a strong, unique password. We have not completed an independent security certification such as SOC 2 or ISO 27001, and we do not claim to have one.
Found a problem?
Email support@viralix.art with the details and steps to reproduce. Please give us a reasonable time to fix it before you disclose it publicly, and do not access other people's data. We acknowledge reports within two business days and will keep you updated.
Try it with a single channel
Connect one account and see how Viralix works. Free while we launch.