Draft for legal review. Highlighted details are still to be added.

Security

Last updated October 27, 2026

Creators trust Postbutter with their account and their audience’s messages. This is how we protect them.

Your Instagram account

You connect through Instagram’s official login and approve each permission. We never see or store your Instagram password.
Postbutter only sends messages to people who contacted you first, within Instagram’s limits, so your account stays in good standing.
You can disconnect at any time, in Postbutter or in Instagram.

Your data

All traffic uses HTTPS (TLS). Data is stored with a cloud provider that encrypts it at rest.
Passwords are hashed with bcrypt. Sign-in sessions use secure, HTTP-only cookies and can be ended by signing out.
API keys and secrets live only in server configuration, never in the browser or in our code.
Every workspace is kept separate: every database query is limited to your workspace, and we test that one workspace can’t read another’s data.
Webhooks from our providers are verified with signatures before we act on them.
Important actions, such as connecting an account or turning an automation on, are recorded in an audit log.
Only the people who need to run and support Postbutter can access production data.

Payments

Cards are handled by our payment provider, which is certified to PCI DSS Level 1. Card numbers never reach our servers.

Report a vulnerability

If you think you’ve found a security issue, email [email protected] with the details and steps to reproduce it. Please don’t access other people’s data, disrupt the service or share the issue publicly until we’ve fixed it. We will reply within 3 business days and keep you updated. We won’t take legal action against good-faith research that follows these rules.

See also our Privacy Policy and Data Processing Addendum.