Security Overview

Channel connection information

Moyeo connects channels through each platform's OAuth sign-in and never receives channel passwords.

• When you connect, you choose which features to use (publishing, comments, performance), and we request only the basic permission needed to identify the channel plus the permissions for the features you chose. The connection screen explains what each feature does, and you can add features later by reconnecting. Permissions for each platform are listed in Social Channel Guide.
• Access tokens and refresh tokens issued by the platform are stored encrypted with AES-256-GCM, using a new initialization vector for every encryption.
• Ciphertext is bound to the workspace, connection, platform and connection generation, so it cannot be decrypted if moved to another workspace or connection.
• Encryption keys carry a version. We encrypt with the newest key and decrypt with the key version used when the data was stored, so keys can be changed without stopping the service.
• Different kinds of data, such as channel tokens, payment methods and bio page visitor information, use different keys.

Account security

• Passwords are stored hashed with Argon2id (64 MiB memory, 3 iterations), and the plaintext is never kept.
• When you sign up with email, your account is created only after you open the verification link sent to you, which is valid for 30 minutes.
• An account can be logged in on up to 5 devices at the same time. If you log in beyond that limit, the device that has gone unused the longest is logged out automatically.
• You stay logged in for up to 30 days, and you are logged out after 7 days of inactivity.
• Account actions such as deleting your account, changing your email, disconnecting a social login and logging out other devices, as well as connecting a channel, registering a payment method, changing or canceling a plan, deleting a workspace, downloading visitor lists and sending newsletters, require re-authentication within the last 15 minutes.
• In the Security menu in settings, you can see the devices you are logged in on and log out each device or all other devices.
• We email you when you log in on a new device, change your password or email, or register a password login.
• We record security activity such as login, logout, password and email changes, connecting and disconnecting social accounts, and account deletion. The user identifiers, leading part of the access IP address and browser information in those records are stored as hashed values instead of the originals.
• Session cookies and device cookies are issued with the HttpOnly, SameSite=Lax and Secure attributes.

Photos and videos

• Files are uploaded directly to storage through a signed upload URL valid for 10 minutes and do not pass through Moyeo's API server.
• Uploaded files are checked against their size and SHA-256 value and actually opened to verify their format. Images are checked for resolution and videos for duration, resolution and codecs, and files that fail inspection cannot be used.
• Posts can use JPEG, PNG and WebP images and MP4 and MOV videos, and bio page file blocks also accept PDF.
• Images are re-encoded into display and publishing versions with orientation corrected and without copying capture information (EXIF, GPS), and only the publishing version is sent to platforms. The original file is kept in non-public storage for the retention period below.
• Videos are published as uploaded without conversion, so location information contained in a video file is not removed.
• Uploaded photos and videos are kept while they are attached to a post or used for a schedule, workspace, profile or bio page. Files not used anywhere are deleted after 7 days, and files that failed inspection after 1 day. The original of a published file is kept for your plan's retention period from the day its last publishing finished and then deleted, and previews are kept while the publishing records remain.
• When you disconnect a channel, we release the usage marks on files used for that channel's schedules and publishing, and those files then follow the retention rules above. When you delete a workspace or your account, its files are deleted too.

Data deletion

• When you disconnect a channel, we cancel that channel's schedules and delete the stored connection information, that channel's scheduling and publishing records, the post lists, comments and performance data fetched from it, its auto-replies and their records, and AI suggestions made from that channel's data.
• When discarding connection information, we ask Google to revoke the token for YouTube, and delete the token stored by Moyeo for Instagram and Threads.
• Disconnecting keeps the posts you wrote in Moyeo and their photos and videos. Posts scheduled only for that channel or not yet published move to drafts, posts published only to that channel move to archived, and posts that also use other channels stay as they are. Posts already published on the platform are not deleted.
• When we receive an account deletion request, we log you out of all devices right away and delete your data in stages. There is no grace period.
• We process data deletion requests coming from Instagram and Threads and provide a code for checking their progress.
• Comments and performance data past your plan's history period are deleted automatically every day.
• When you delete a bio page, its submissions, guestbook entries, newsletter records, reports and visit aggregates are deleted immediately.
• How to request deletion and deletion deadlines are described in Data Deletion Instructions.

If a security incident occurs at Moyeo that affects users, we notify them without delay by email and service notice.

Service protection

• Servers and the database run in the Amazon Web Services Seoul region, and the database and server disks are encrypted.
• Servers cannot be reached directly from outside and accept only requests that come through Cloudflare. The database is not exposed to the internet and accepts connections only from Moyeo's servers.
• Excessive requests are limited automatically. The default is 1,200 per minute, with stricter separate limits on authentication requests such as login, sign-up and password reset.
• We accept requests only from allowed origins and apply standard security headers.
• Requests that change data are checked to come from an allowed origin and not from another site, and cookies are issued with SameSite, to prevent cross-site request forgery.
• Requests that must not run twice, such as publishing, use idempotency keys to prevent duplicate processing.

Bio page public forms

• Reservation, inquiry, newsletter sign-up and guestbook forms use Cloudflare Turnstile to check that a person sent them. When the check server cannot be reached, the rate limits below provide protection.
• Submissions, guestbook entries, reports, unsubscribe requests and file downloads sent from the same IP to the same bio page are accepted up to 5 times per minute, and visit records up to 60 times per minute. Submissions also have a limit of 100 per page per day and the plan's monthly limit, and guestbook entries a limit of 30 per page per day.
• Visitor IP addresses are used only at Cloudflare for bot checks and rate limits and are not sent to or stored on Moyeo's servers. Visit statistics are also stored only as daily and hourly aggregates, with no visitor identifier or IP.
• Visitors' names, contact details and submission content are stored as AES-256-GCM ciphertext bound to each submission. We check whether the same email has already signed up for a newsletter using a non-reversible HMAC digest.
• Downloading visitor lists requires re-authentication within the last 15 minutes, and the person who downloaded and the number of rows are recorded.
• Guestbook entries are not public until the member who created the bio page approves them.
• Newsletter unsubscribe links are signed per recipient so they cannot be forged, and one-click unsubscribe in email programs is supported.
• Public pages restrict script origins with a Content Security Policy, and the origins of visit analytics tools connected by the member are allowed only on that page.

Privacy and analytics

• Visit and feature usage analytics for Moyeo's app are collected by default with Google Analytics. Values in addresses such as workspace IDs are masked, a pseudonymous analytics ID that cannot be traced back to your account ID is sent instead of the account ID when you are signed in, email and post content are not sent, and ad personalization signals are turned off. Completed payments, channel connections and published posts are sent to Google Analytics by the server after it confirms them. We respect an analytics opt-out you saved earlier and your browser's blocking settings. See the Privacy Policy for collected information and collection controls.
• Error reports contain only the internal user and workspace identifiers and screen path needed to find the cause; URL query strings, cookies, request headers, email, names and request and response bodies are removed, and session recording is not used.
• Server logs record only predefined fields and do not contain passwords, tokens, cookies or plaintext email addresses.
• The inquiry body and the screen path and browser information sent with it are stored in Moyeo's database. The email address and display name needed for our reply are not kept in the inquiry record; they are read from the logged-in account, kept encrypted only until the email to the operator is sent, and then deleted.
• The support team can see only the performance data and posts of channels that the workspace owner has allowed, and only for the allowed period (7 days by default, up to 30 days). The owner can revoke access at any time in security settings, and each view by the support team is recorded.
• Notification emails sent to operators do not contain passwords, authentication tokens or card numbers. Outage alert emails do not contain personal information.

Vulnerability reports

If you find a security issue in Moyeo, please let us know at support@moyeo.io.

Related documents

• Privacy Policy
• Data Deletion Instructions
• Platform Data Use Notice

Revision history