Credential encryption
Every social-platform credential BufferUp stores — OAuth access and refresh tokens, and Bluesky app passwords — is encrypted with AES-256-GCM before it is written to the database. Each record is encrypted under a fresh random initialization vector and carries an authentication tag, so tampering with stored ciphertext is detected rather than silently decrypted.
The encryption key is held only in the server environment. It is never sent to the browser, never written to the database alongside the data it protects, and never included in logs or error reports.
Workspace isolation
Data is scoped to the organization that owns it. Every request that reads or writes clients, channels, or posts is checked against the caller’s active organization before any query runs, so one agency cannot reach another’s workspaces and one client’s content cannot be published to another client’s channels.
Authentication
Accounts, sessions, and organization membership are handled by Clerk. BufferUp never sees or stores your password. Multi-factor authentication and social sign-in are available and are configured in your account settings.
Platform permissions
BufferUp requests the narrowest set of OAuth scopes each feature needs, and only at the point you connect a channel. Access can be withdrawn at any time — disconnect the channel in BufferUp, or revoke BufferUp from the platform’s own app settings. Disconnecting deletes the stored credentials for that channel.
Data in transit and at rest
- All traffic to BufferUp is served over HTTPS with TLS.
- The application database is a managed Postgres instance with encryption at rest and access restricted to the application’s server environment.
- Uploaded media is stored in managed object storage, not on application servers.
Publishing safeguards
Posts move through an explicit state machine — draft, pending review, scheduled, publishing, published, or failed. A post cannot skip from draft to published without the approval step your workspace configures, and a failed publish is recorded with its reason rather than being retried blindly or dropped.
Reporting a vulnerability
If you believe you have found a security issue, email info@nexifyme.com with the subject “security report”. Please include enough detail to reproduce the issue, and give us a reasonable opportunity to investigate and remediate before any public disclosure. We will acknowledge your report and keep you updated on our progress.
Scope of these statements
This page describes the controls BufferUp implements today. It is not a certification, and it does not claim compliance with any specific audit standard. If your organization requires a formal security review, contact us at info@nexifyme.com.