SECURITY & CONTROL
Understand how SocialCli protects credentials, keeps approvals explicit and helps you control access.
YouTube available / More platforms coming soon
Provider application secrets stay on the hosted service, outside the public client package.
HTTPS protects transport. Sensitive service vault records are encrypted at rest.
You sign in and authorize your account in your own browser. Keep passwords and email codes out of chat.
Connecting an account or starting a subscription does not authorize publication. Your assistant prepares the complete preview, gets your explicit approval and checks the result afterward.
Provider permissions can cover more than one command. SocialCli’s scoped access is not a sandbox for a malicious assistant: a provider access token is governed by the provider’s own scopes. Use an assistant and environment you trust.
Revoke assistant access or disconnect a provider in My Account. Already-issued provider tokens may remain valid until they expire or are revoked. Remove the app in the provider’s settings when you need to revoke the provider grant.
SaaS installations use a supported OS keyring or an explicitly configured encrypted-file store. There is no silent plaintext fallback. Keep the encryption key outside the workspace and preserve it securely; a lost key cannot be recovered from the encrypted file.
Independent provider-app authentication can use local .secrets files with restricted permissions. These legacy files are not an encrypted vault. They require separate protection by the operator.
Managed YouTube API observations expire after six days. Your originals, exported chats and reports require separate handling. Read the privacy policy for the full retention and deletion rules.
Encrypted operational backups are stored in an operator-controlled Google Drive destination. This does not require access to your Google Drive. Earlier account data may remain in protected backups until removed under the published retention policy.
Instagram is not publicly available. Its SaaS workflow can temporarily stage supplied originals on florentino.pro outside backups. Opaque HTTPS links expire 15 minutes after reservation; anyone with a valid link can retrieve the file. Cleanup removes staged files, and resumes after an infrastructure outage. Keep your own original and do not share temporary media links.
Email admin@socialcli.app with a description and safe steps to reproduce the issue. Do not include passwords, tokens or other people’s private account data.
If a credential is exposed, revoke and rotate it with the provider. Deleting a file or commit does not invalidate a credential.