Security
What protects your account, plainly.
This page lists what Oocta does to keep your business, your accounts and your posts safe. Each line is something the product does today, not a plan.
What Oocta does
6 things you can count on.
Nothing posts without an approval
Every post waits for you in review. Autopilot can approve on its own only after you’ve earned it, inside limits you set, and you can pause it in one click.
Enforced by the database: it refuses to schedule a post that has no approval recorded, whoever asks.
Your data is walled off from other accounts
Every table in Oocta’s database has row-level security switched on. The database checks whose a row is before a signed-in browser can read or change it, and some tables can’t be reached from a browser at all.
Switched on in the database for every table, not only in the app’s code.
Connected accounts are encrypted
When you connect a social account to Oocta directly, the access keys the platform gives us are encrypted on our server before they are stored, and only Oocta’s server can decrypt them.
AES-256-GCM, with a key that exists only on the server. The code that decrypts can’t run in a browser.
Stripe handles your card
You enter your card on Stripe’s checkout page, not on Oocta’s. Oocta never sees or stores your card number.
Oocta keeps a reference to your Stripe customer and subscription, not the card.
Your plan can’t be changed from a browser
Your plan, your trial and your billing status can only be changed by Oocta’s server, never by a request from a browser, including your own.
A database rule turns down any browser change to those fields.
Breached passwords are turned down
Oocta’s sign-up and password-reset screens refuse a password that appears in known data breaches. Only a short piece of a scrambled form of the password is checked, never the password itself.
The check runs on those screens before the password is sent. If it can’t be reached, sign-up goes ahead rather than locking you out.
What we don’t claim
No badges we haven’t earned.
Oocta does not hold a third-party security certification or an audit report today. When that changes, it will be listed here with what it covers.
The companies that process data for Oocta, such as hosting, payments and email, are listed on the subprocessors page. What we collect and why is in the privacy policy.
Found a problem?
Tell us privately.
Email hello@oocta.work with the subject “SECURITY”, what you found and how to reproduce it. Please don’t post it publicly first. We aim to acknowledge a report within 3 business days.
Start with one offer
Tell Oocta what you’re promoting.
It plans the campaign from what you already have and brings every post to you first. You approve what goes out.
7-day trial · card required · cancel anytime