Security

Last updated: October 23, 2026 · Unposted and Unposted for Agencies are operated by G2 Advisors.

This page describes the controls in the product today. We do not hold a SOC 2 report, and we have not published a penetration test.

Isolation

Each customer is a tenant. Tenant-scoped data lives in Postgres with row-level security forced on: a query runs with that tenant's id set for the transaction, and the database rejects rows that are not theirs. The application is not the only thing standing between two agencies' books.

Access and sign-in

Sign-in is WorkOS AuthKit. The front door is Continue with Google, or a one-time code to your email. A password is not required to sign in. You can set one later from your account. The app keeps a session for 72 hours. It does not store your password. Production refuses to boot with the development login shortcut turned on. Seats on a firm plan are billed to the account owner. The product does not offer customer-managed single sign-on, and it does not enforce multi-factor authentication. LinkedIn is a connected account for sending, not a way to sign in.

Transport and storage

The app, the API, and the database are reached over TLS. Hosting is Vercel (web) and Railway (API), with the database on Neon in the United States. Connected-mailbox and similar credentials can be stored in an application envelope encrypted with AES-256-GCM. We do not store Google tokens ourselves when Nylas holds the mailbox grant. Card numbers are stored by Stripe, not by us.

Sending

Email goes out from mailboxes the customer connects, through Nylas. LinkedIn actions go out through Unipile on the account the customer connects, inside daily caps. The default mode is review: a first touch waits for a person. Auto-send is a setting the customer turns on. Opt-outs are written to a suppression list the send path checks. Details are in the Privacy Policy and the Terms.

Application controls

• Production CORS is an allowlist. It fails closed if the allowlist is unset.
• The web app sends a content-security policy with a per-request script nonce.
• API requests are rate-limited per session or IP.
• Inputs at the API boundary are validated. Queries are parameterized.
• Error reports (Sentry) are scrubbed of secrets and email addresses before they leave the process.
• Product analytics (PostHog) starts only after the in-app cookie choice. The marketing site does not load the Apollo visitor tracker until the same kind of choice.

What we will not claim

• No SOC 2 Type I or Type II report.
• No published penetration test.
• No bug-bounty program.
• No contractual uptime SLA on the self-serve plan.

Report a problem

Email eric.hawthorne@g2advisors.io with the subject "Security". Include what you found and a way to reply. There is no bounty.

Agencies that need a processing addendum can start from the DPA template.