Security

Last updated 4 November 2026

Brand Autopilot holds the keys to your social accounts and your unpublished content, so we design it on the assumption that every layer may one day fail, and make sure the next one still holds. This page describes what we do in plain words.

Your company's data stays separate

Each company is a separate workspace. The database itself enforces the separation (row-level security), so a mistake in the app cannot show one company's data to another.
The app connects to the database with a role that owns nothing and cannot bypass that separation.
Which company you are working in comes from your signed-in session and a membership check, never from the browser alone.

Signing in

Accounts are created by invitation only; there is no public sign-up.
Passkeys and two-step verification with an authenticator app are supported, and we recommend turning one on.
Passwords are at least 12 characters, stored only as salted hashes, and checked against known breaches without the password ever leaving our servers.
Sign-in attempts are rate limited, and sessions expire after 12 hours.

Connected social accounts

We use only each network's official API and sign-in. We never ask for, or store, your social media passwords.
Access tokens are sealed (encrypted) so that only the publishing service can open them. The web app cannot read them back.
We ask only for the permissions a feature needs, and disconnecting an account deletes its tokens.

AI and untrusted text

Comments, web pages and uploaded documents are treated as data, never as instructions, and cannot cause anything to be published on their own.
Nothing is published without a person's approval, apart from automatic comment replies that a company turns on, which run within a daily limit. See AI and automation.

On the web

All traffic is encrypted in transit, and pages are served with a strict Content Security Policy, HSTS and protections against framing.
Uploaded images are served with no scripts allowed, and location and camera details are removed from uploads.
Forms are protected against cross-site requests, and the public contact form is rate limited.

Records and operations

Important actions, such as approvals, role changes and billing, are written to an audit log that cannot be edited.
Logs leave out anything that looks like a secret.
Every change to the code is checked for leaked secrets, vulnerable dependencies and licence problems before it ships.
Payments are handled by Paystack. Card numbers never reach our servers.

What you can do

Turn on a passkey or two-step verification in Security, inside the app.
Give each person the lowest role that lets them do their job, and remove people who leave.
Review connected accounts in Channels from time to time, and disconnect any you no longer use.

Reporting a vulnerability

If you think you have found a security problem, email privacy@utawaziea.com with “Security report” in the subject, and include the steps to reproduce it. Please do not access other people's data, disrupt the service, or share the issue publicly before we have fixed it. We will acknowledge your report and keep you updated while we work on it. Testing beyond this needs our written permission, as our acceptable use policy explains.