Security and privacy
Where FeedHorizon stores data, how it protects tokens and keys, and what happens to data when you delete it.
Where data lives
- Servers and database in the EU. The app runs in Frankfurt, Germany, and the database and media files are stored in the same region.
- Service providers for hosting, email, error reports and the like work for us under data processing agreements. The full list, with the legal basis for each kind of data, is in the privacy policy.
Social accounts
- FeedHorizon never sees passwords. You sign in at the platform, which hands FeedHorizon an access token. Bluesky is the exception: it uses an app password that you create for FeedHorizon and can revoke in Bluesky at any time.
- Access tokens, refresh tokens and app passwords are encrypted at rest with AES-256-GCM.
- FeedHorizon asks each platform only for the permissions it needs to publish and to show the account's name. Each platform page lists them.
- Disconnecting an account deletes its tokens. You can also revoke access on the platform's side; the account then turns
needs_reauththe next time FeedHorizon uses it.
API keys, links and webhooks
- API keys are stored only as a SHA-256 hash and shown once, when you create them. A key can be limited to some scopes and profiles, and can expire.
- Connect links are stored as a hash too; the link itself is shown once. Each works once and for 7 days.
- Webhook secrets are stored encrypted. Every delivery is signed with HMAC-SHA256 and a timestamp, so your server can reject forged or replayed requests. See Verify signatures.
- Media imports from a URL only fetch public
httpsaddresses, never private networks.
Access
- Every API request, MCP call and dashboard action is checked against one organization. A key or a member never sees another organization's data.
- Members can be limited to some profiles. Assistants connected over MCP have the same limits as the person who connected them, and you can disconnect them under API & Apps.
- Requests are rate limited per key; see Rate limits.
Deleting data
| You delete | What is removed |
|---|---|
| A post | The post in FeedHorizon. Posts already live stay on the platforms |
| A media file | The file, once no post uses it |
| An account | Its tokens and its scheduled posts |
| A profile | Its accounts, posts and queue |
| The organization | Its profiles, accounts, posts, media and keys |
Webhook delivery logs are deleted after 30 days. Server logs hold the request id, route, status and error code, not the content of posts, and are kept only for a short time. Invoices are kept as long as tax law requires.
Reporting a vulnerability
If you find a security problem, write to info@feedhorizon.com and describe how to reproduce it. Please give us time to fix it before you make it public.