Security & trust
Repping.AI handles creator content, connected social accounts, publishing actions, and billing workflows. This page summarizes the safeguards we can describe from the current product, privacy policy, terms, and codebase.
Account and session protection
Authentication is backed by Firebase-issued identity, Repping session cookies, token-version checks for revocation, and CSRF protection on browser-based state-changing requests.
Connected social account data
OAuth tokens and integration credentials are encrypted at rest with AES-256-GCM envelope encryption. Tokens are decrypted only when needed to publish, refresh, or read data for a connected account.
Data minimization
The privacy policy states that Repping does not sell personal data, does not run third-party advertising, and uses sub-processors for specific functions such as hosting, storage, billing, email, analytics, error monitoring, and background jobs.
Operational controls
Mutating routes use CSRF checks or explicit non-cookie authentication, public endpoints are rate-limited, payment webhooks use provider signatures, and state-changing product workflows record audit events where implemented.
Security and privacy details
These are the practical controls we apply across accounts, connected platforms, billing, and support workflows.
- Data is encrypted in transit with modern TLS and protected with hardened authentication and session controls.
- Connected Google and YouTube data is used only to power the YouTube features a user enables.
- Card payments are processed by Polar as merchant of record; Repping does not store full card numbers.
- Error monitoring is configured to avoid sending request bodies and known personal data.
- Account export and deletion requests are available from account settings, with retention handled under the privacy policy.
Connected platforms and third parties
Repping publishes only to platforms you connect and only sends the content you ask us to publish. Platform handling is governed by each platform’s own terms and privacy policy. Current sub-processors are listed in the privacy policy, including MongoDB Atlas, Cloudflare R2, Polar, Firebase Authentication, Resend, PostHog, Sentry, Trigger.dev, Vercel, and the social platforms you connect.