Security

SocialiQ is a unified, normalized REST API for public social-media data across TikTok, Instagram, YouTube, Reddit, X/Twitter, Threads, and LinkedIn. You integrate it with an API key, you pay for what you use, and you get one consistent shape back. This page explains, in plain terms, how we handle the things developers care about: your keys, your data, and the boundaries of what we can see.

We have tried to be precise here rather than aspirational. Where something is on our roadmap rather than in place today, we say so.

API keys

Your SocialiQ keys are formatted sc_live_… and are the credential for every request you make. We treat them carefully:

• Shown once, on creation.When you generate a key in the dashboard, the full value is displayed a single time. Copy it then and store it somewhere safe (a secrets manager or your platform's environment variables). We cannot show it to you again.
• Stored hashed, never in plaintext. We do not keep a recoverable copy of your key. We store a one-way hash and verify incoming requests against it, so even we cannot read your key back out of our database.
• Revocable at any time. If a key is leaked, committed to a repo, or simply no longer needed, you can revoke it from the dashboard and it stops working immediately. You can run multiple keys at once and rotate them without downtime.

Treat your keys like passwords. Do not embed them in client-side code, mobile apps, or public repositories — anywhere a key ships to an end user, assume it is compromised. If you think a key has been exposed, revoke it and issue a new one. If you ever spot suspicious usage you cannot explain, email security@socialiq.dev and we will help you investigate.

Encryption in transit

All traffic to and from SocialiQ — API requests, dashboard sessions, and webhooks — runs over HTTPS with TLS. Plaintext HTTP connections are not accepted; they are redirected or rejected. Your API key and your request and response payloads are encrypted on the wire between your infrastructure and ours.

Payment security

Billing and payments are handled by Stripe, a PCI-DSS compliant payment processor. Card details are entered directly into Stripe's hosted, tokenized fields — SocialiQ never sees, handles, or stores your full card number. We keep only the non-sensitive references Stripe returns to us (such as a customer ID, the last four digits, and the card brand) so we can show you your billing history. Outsourcing this to a dedicated processor is deliberate: it keeps the most sensitive data you could give us off our systems entirely.

Infrastructure and subprocessors

We run on established cloud providers rather than home-grown infrastructure, and we keep the list of who touches your data short and explicit:

• Vercel and Railway — application and API hosting.
• Supabase — our primary database, where account and usage records live.
• Clerk — authentication and session management for the dashboard.
• Stripe — payments and billing, as described above.

Each of these is a reputable provider with its own security program. They are the only third parties involved in operating your account. The data we draw on to fulfill API responses comes from licensed and third-party data providers; the specifics of those arrangements are confidential.

Data minimization

SocialiQ returns public social-media data, and we are intentionally uninterested in your downstream usage of it. We store the metadata we need to run the service — your account details, your API keys (hashed), and usage records such as which endpoints you called, when, and how many calls you made for billing and rate limiting. We do not build a warehouse of the response bodies you fetch, and we do not retain the social data you pull as a product of its own. Less data on our side is less to lose.

Responsible disclosure

If you discover a vulnerability in SocialiQ, we want to hear about it. Please report it to security@socialiq.dev with enough detail for us to reproduce the issue — steps, affected endpoints or pages, and any proof-of-concept you can share.

Our commitment to good-faith security researchers:

• We will acknowledge your report promptly and keep you updated as we investigate.
• We will not pursue or support legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us a reasonable chance to fix the issue before disclosing it publicly.
• We ask that you do not access, modify, or delete data that is not your own, and that you avoid degrading the service for other users while testing.

We do not run a paid bug-bounty program at this time, but we genuinely appreciate the work and are happy to credit researchers who would like recognition.

Certifications

To be straightforward: SocialiQ does not currently hold SOC 2, ISO 27001, or similar formal certifications, and we have not undergone a third-party penetration test. We would rather tell you that than imply otherwise. Formal certifications and independent security assessments are on our roadmap as the product matures. In the meantime, the practices described above — hashed and revocable keys, TLS everywhere, payments offloaded to Stripe, and deliberate data minimization — are in place today.

Contact

Security reports go to security@socialiq.dev. For everything else — billing, integration help, or general questions — reach us at support@socialiq.dev.