Security

Effective date: July 2026
Applies to: Vantr, and everyone using it

Vantr holds the keys to your social accounts, so this page sets out exactly how those credentials and your content are protected — and, just as plainly, which assurances we are not in a position to give.

1.Platform credentials

1.1

Connecting a platform to Vantr never involves giving us your password. You authorise access on the platform's own site through OAuth, and the platform returns a token scoped to the permissions you approved.

1.2

Those access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, using a key held outside the database itself. Anyone reading the database, or a backup of it, sees only ciphertext. Tokens are decrypted in memory only at the moment an API call needs them.

1.3

We request the narrowest set of permissions each platform offers for the features we provide. You can see the scopes granted for each connection in your settings, and revoke any connection at any time — from Vantr, or from the platform's own security settings.

1.4

Disconnecting a platform revokes our token immediately. It does not delete anything already published there; that has to be removed on the platform.

2.Data isolation

2.1

Every table in our database enforces row-level security. Authorisation is applied by the database itself rather than only in application code, so a query can only return rows belonging to the requesting user's workspace — even if application code contains a mistake.

2.2

Workspaces separate members by role: owner, administrator, editor and client. Roles govern who can publish directly, who must submit posts for approval, who can manage connections, and who can see billing.

2.3

Server-side operations that need elevated database access run only in trusted server contexts and are never exposed to the browser.

3.Infrastructure

3.1

The application is hosted on Vercel and data is stored with Supabase, both established providers that maintain their own physical, network and personnel security controls, and both of which undergo third-party audits of their own infrastructure.

3.2

All traffic between your browser and Vantr is encrypted in transit using TLS. Data is encrypted at rest by our infrastructure providers, with platform tokens additionally encrypted by us as described above.

3.3

Payments are handled entirely by Stripe. Card details are submitted directly to Stripe and never reach our servers, so we hold no card numbers to lose.

3.4

Passwords are never stored in plain text. Authentication, including any third-party sign-in you use, is handled by our identity provider.

4.What we do not claim

4.1

We would rather tell you what we do not have than let a page like this imply otherwise.

4.2

As of the effective date above:

Vantr has not completed a SOC 2, ISO 27001, or equivalent security certification, and we do not claim to hold one.
We have not commissioned an independent penetration test.
We do not offer a contractual uptime commitment or service level agreement.
We do not currently operate a paid bug bounty programme, though we do want to hear from researchers.

4.3

No system is perfectly secure. We apply the controls described here in good faith, but we cannot and do not guarantee that the Service will never be compromised.

5.Reporting a vulnerability

5.1

If you believe you have found a security issue, email support@vantr.app with enough detail for us to reproduce it. We aim to acknowledge reports within five business days.

5.2

We will not pursue legal action against researchers who act in good faith. Acting in good faith means:

giving us a reasonable opportunity to fix the issue before disclosing it publicly;
not accessing, modifying, or deleting data belonging to anyone other than yourself;
not degrading the Service for other users, including through automated scanning at volume;
not using social engineering, physical attacks, or attacks against our service providers.

5.3

We are a small operation and cannot currently offer monetary rewards, but we will credit researchers who want the acknowledgement.

6.Incidents

6.1

If we discover a breach of personal data that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify affected users without undue delay where the risk is high.

6.2

Our notice will describe what happened, what data was involved, what we have done, and what we recommend you do.

7.Your part

7.1

The controls above only work alongside good account hygiene:

use a strong, unique password, and enable two-factor authentication on your connected platform accounts;
invite people to your workspace only at the role they actually need;
remove members who no longer need access, and disconnect platforms you no longer publish to;
tell us promptly at support@vantr.app if you think your account has been accessed by someone else.