Security
How we protect your data
A plain summary of the controls in place. If you need something more formal for a procurement review, get in touch.
Credentials
- Passwords hashed with bcrypt — never stored or logged in plain text
- Access tokens are short-lived JWTs; refresh tokens are opaque, stored hashed, and rotate on every use
- Sign-in endpoints are rate limited to blunt credential-stuffing attempts
Administrator API keys
- Third-party keys entered in the admin panel are encrypted with AES-256-GCM before storage
- The encryption key lives only in the process environment, never in the database
- Keys are masked in every API response — the full value is never returned to a browser
- GCM authentication tags mean tampering is detected rather than silently decrypted
Payment data
- Card details are handled entirely by our payment processor and never touch our servers
- Stripe webhooks are signature-verified; unverified webhooks are refused outright
- Payout records are immutable once marked paid, so the ledger cannot be quietly rewritten
Access control
- Role-based access across creator, brand, agency and admin
- Workspace scoping enforced at the query layer, not in the interface
- Team seats carry granular roles — viewers cannot invite, members cannot touch billing
- Removing a team member revokes access immediately across every surface
Auditing
- Security-relevant actions are written to an append-only audit log
- Settings changes record who and when — never the secret value itself
- Unhandled errors return a reference id instead of a stack trace, so diagnosis never requires leaking internals
Infrastructure
- Hosted in the EU (Frankfurt) with encryption in transit throughout
- HSTS, X-Frame-Options, nosniff and a restrictive permissions policy on all responses
- Database migrations run at deploy time so schema and code never drift apart
- Health and readiness checks let a bad deploy fail fast instead of serving errors
Reporting a vulnerability
If you believe you have found a security issue, email security@infludubai.com with enough detail to reproduce it. We aim to acknowledge within one business day and will keep you updated until it is resolved. Please do not publicly disclose an issue before we have had a chance to fix it, and please do not access, modify or delete data belonging to anyone other than yourself while testing.
This page describes controls that are implemented in the product today. It is not a certification claim — we do not currently hold SOC 2 or ISO 27001. If a formal attestation is required for your procurement process, contact us and we will tell you honestly where we stand.
See also our privacy policy and acceptable use policy.