Security
Access that stays narrow and visible.
Connecting a brand to Optomus should never mean handing over the keys. This page explains what we store, what we don't, and what you control.
Your connected accounts
Official sign-in only
LinkedIn, Instagram, Facebook, X and TikTok connect through each platform's OAuth flow, with only the permissions publishing needs, and posts go out through each platform's official API. We never see or store your social passwords.
Tokens encrypted at rest
Platform access tokens are encrypted with a dedicated key before they're stored, and are never written in plain text.
Disconnect whenever you like
Disconnecting an account from Settings revokes Optomus's access immediately, with no support ticket.
Your Optomus account
Short-lived sessions
Access tokens expire after 15 minutes and refresh tokens after 30 days. Signing out invalidates them.
Verified email and hashed passwords
Every account verifies its email before use. Passwords are hashed with bcrypt and cannot be read back, even by us.
Rate limits
Sign-in and API endpoints are rate-limited to slow down guessing and abuse.
Your team and content
Roles per brand
Owner, Admin, Editor and Viewer roles control who can create, edit, approve and publish, brand by brand.
Approval before publishing
Require sign-off on a brand and nothing is scheduled until a named approver agrees.
Audit log
Important actions are recorded with who did them and when, so changes can always be traced.
Found a problem?
If you believe you've found a security issue, email support@optomusai.com with the details and we'll respond as quickly as we can. For how we handle personal data, read the privacy policy.
Your next month of posts, planned this afternoon.
Connect your accounts, describe the campaign, and review the first drafts before you close the tab.
14-day free trial · no credit card needed