ReposterX

Security

How we protect your account and your data.

Handing over access to your account is a matter of trust. Here is exactly what we do with it, what we never do, and how your session token is protected.

Our commitment when we access your account

We never ask for your X password. To handle your groups, we use a revocable X session token that you save in your dashboard. This is exactly what that access is used for.

With access to your account, we only

  • Use your X session only to run the service you subscribed to
  • Open your groups through the direct chat links you give us, and nothing else
  • Repost and react to the posts shared in those groups
  • Share in those groups the links of your own posts that you add in your dashboard

We will never

  • Create anything on your account: no posts, no replies, no quotes, no messages
  • Open, read or search your private messages (DMs) or any conversation other than the groups you listed
  • Follow, unfollow, block, like outside your groups, or change your profile, settings or password
  • Ask for your password, or sell, share or use your session token or your data for any other purpose

How your access and data are protected

Encrypted before storage

Your session token is encrypted with AES-256 on our server before it reaches the database. The key is kept separately from the data, and nobody can read the token from the database.

Write-only from your side

Once saved, your token is never displayed again, not even to you or our team. You can replace it or remove it at any time from your dashboard.

Restricted and logged access

Only our reposting engine can use it, one account at a time, and every use is recorded in an audit log. Our team sees whether access is saved, never the token itself.

Deleted when you leave

Your token is deleted as soon as your subscription ends, when you remove it, or when you delete your account. Our engine deletes its copy of your session too.

You stay in control

Remove our access in one click from your dashboard, or end the session from your X settings (Apps and sessions). We never need your password or your two-factor codes.

Only in your dashboard

Never send your session token by email or message, even to us. Anyone asking for it outside your dashboard, or asking for your password, is not us.

Payments

Payments are handled by Stripe. Your card details never reach our servers and are never stored by us.

Isolated, confidential data

Every database table is protected by row-level security: each client can only reach their own data. Your data is never sold or shared, and only used to run your groups.

Report a security issue

If you think you have found a vulnerability, or someone contacted you pretending to be us, email contact@reposterx.com. We reply as fast as we can and keep you informed.