Security
Last updated: July 17, 2026
Our Commitment to Security
Security is foundational to AIworX. We implement industry-standard practices to protect your data, your Instagram account, and your business. This page outlines the measures we take to keep your information safe.
Encryption
Data in Transit
- All communication between your browser and our servers uses HTTPS with TLS 1.2 or higher
- API communications with Meta platforms are encrypted end-to-end
- Webhook payloads are verified using HMAC signatures
- Secure WebSocket connections for real-time features
Data at Rest
- Database encryption using AES-256
- File storage encryption for backups and media
- Encrypted volumes for all storage systems
- Encryption key management through dedicated KMS
HTTPS and TLS
All connections to AIworX are encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints and implement the following:
- Automatic SSL/TLS certificate provisioning and renewal
- HTTP Strict Transport Security (HSTS) headers
- Secure cookie attributes (HttpOnly, Secure, SameSite)
- Content Security Policy headers
- Regular TLS configuration audits
We do not support or allow unencrypted HTTP connections to any part of the service.
Access Token Security
Access tokens for Facebook and Instagram are highly sensitive credentials. We protect them with multiple layers of security:
Encrypted Storage
All access tokens are encrypted using AES-256 before being stored in our database. The encryption keys are managed separately from the database and rotated regularly.
Minimal Access
Access tokens are only decrypted when needed for API calls and are never logged, displayed in plain text, or stored in cache outside of encrypted storage.
Automatic Revocation
When you disconnect your Instagram account, all associated tokens are immediately and permanently deleted from all systems, including backups.
No Third-Party Sharing
Access tokens are never shared with any third party. All API calls are made directly from our servers to Meta's APIs.
Password Security
We take password security seriously and implement the following measures:
- Bcrypt hashing: All passwords are hashed using bcrypt with a cost factor of 12
- Automatic salting: Each password is automatically salted using a unique, cryptographically random salt
- One-way hashing: Passwords cannot be reversed or decrypted. We only store the hash
- No plaintext storage: Passwords are never stored in plain text, logs, or backups
- Password requirements: Minimum 8 characters required at registration
Backups and Data Recovery
We maintain regular backups to ensure data availability and disaster recovery:
- Automated daily database backups with point-in-time recovery
- Encrypted backup storage in geographically separate locations
- Backup encryption using the same AES-256 standard as primary data
- Regular backup restoration testing to verify integrity
- 30-day backup retention policy
Backups are stored in encrypted form and are accessible only to authorized personnel for disaster recovery purposes.
Infrastructure Security
Our infrastructure is designed with security as a core principle:
Network Security
- Web Application Firewall (WAF) for DDoS and attack mitigation
- Network segmentation and isolation
- Intrusion detection and prevention systems
- Rate limiting on all public endpoints
Server Security
- Hardened operating system configurations
- Automatic security patching
- Minimal installed packages (principle of least privilege)
- Root access disabled and restricted
Application Security
- SQL injection prevention through parameterized queries
- Cross-Site Scripting (XSS) protection
- Cross-Site Request Forgery (CSRF) tokens
- Input validation and sanitization
Access Control
- Role-based access control (RBAC) for all systems
- Multi-factor authentication for administrative access
- Principle of least privilege for all access
- Regular access reviews and revocation
Incident Response
We maintain a comprehensive incident response plan to address security incidents promptly:
Detection and Monitoring
24/7 automated monitoring for suspicious activity, unauthorized access attempts, and anomalous behavior patterns.
Immediate Containment
Upon detection, affected systems are isolated immediately to prevent further exposure.
Investigation and Assessment
Root cause analysis and scope assessment are conducted by the security team.
User Notification
Affected users are notified within 72 hours of confirming a data breach, in compliance with GDPR and other regulations.
Remediation and Prevention
Security measures are updated to prevent recurrence, and the incident is documented for future reference.
Security Audits
We conduct regular security assessments to identify and address vulnerabilities:
- Automated dependency vulnerability scanning
- Regular penetration testing by qualified security professionals
- Code security reviews during development
- Configuration audits for all infrastructure components
- Third-party security assessments
Reporting Security Issues
If you discover a security vulnerability in AIworX, please report it responsibly:
Security Disclosure
Email: security@aiworx.io
We ask that you do not publicly disclose the vulnerability until we have had a chance to address it. We will respond to security reports within 48 hours.