# Security and privacy (/docs/help/security)



Where data lives [#where-data-lives]

* **Servers and database in the EU.** The app runs in Frankfurt, Germany, and the database and media files are stored in the same region.
* **Service providers** for hosting, email, error reports and the like work for us under data processing agreements. The full list, with the legal basis for each kind of data, is in the [privacy policy](/privacy).

Social accounts [#social-accounts]

* FeedHorizon never sees passwords. You sign in at the platform, which hands FeedHorizon an access token. Bluesky is the exception: it uses an app password that you create for FeedHorizon and can revoke in Bluesky at any time.
* Access tokens, refresh tokens and app passwords are encrypted at rest with AES-256-GCM.
* FeedHorizon asks each platform only for the permissions it needs to publish and to show the account's name. Each [platform page](/docs/platforms/overview) lists them.
* Disconnecting an account deletes its tokens. You can also revoke access on the platform's side; the account then turns `needs_reauth` the next time FeedHorizon uses it.

API keys, links and webhooks [#api-keys-links-and-webhooks]

* **API keys** are stored only as a SHA-256 hash and shown once, when you create them. A key can be limited to some [scopes](/docs/api/authentication#scopes) and profiles, and can expire.
* **Connect links** are stored as a hash too; the link itself is shown once. Each works once and for 7 days.
* **Webhook secrets** are stored encrypted. Every delivery is signed with HMAC-SHA256 and a timestamp, so your server can reject forged or replayed requests. See [Verify signatures](/docs/guides/webhooks#verify-signatures).
* **Media imports** from a URL only fetch public `https` addresses, never private networks.

Access [#access]

* Every API request, MCP call and dashboard action is checked against one organization. A key or a member never sees another organization's data.
* Members can be limited to some profiles. Assistants connected over [MCP](/docs/mcp) have the same limits as the person who connected them, and you can disconnect them under **API & Apps**.
* Requests are rate limited per key; see [Rate limits](/docs/api/rate-limits).

Deleting data [#deleting-data]

| You delete       | What is removed                                                   |
| ---------------- | ----------------------------------------------------------------- |
| A post           | The post in FeedHorizon. Posts already live stay on the platforms |
| A media file     | The file, once no post uses it                                    |
| An account       | Its tokens and its scheduled posts                                |
| A profile        | Its accounts, posts and queue                                     |
| The organization | Its profiles, accounts, posts, media and keys                     |

Webhook delivery logs are deleted after 30 days. Server logs hold the request id, route, status and error code, not the content of posts, and are kept only for a short time. Invoices are kept as long as tax law requires.

Reporting a vulnerability [#reporting-a-vulnerability]

If you find a security problem, write to [info@feedhorizon.com](mailto:info@feedhorizon.com) and describe how to reproduce it. Please give us time to fix it before you make it public.