Data and security

How client data is protected

onfleeksocial.com · operated by on fleek GmbH

on fleek Social holds the content, the media and the account connections of independent companies we work for. Each of these companies has an area of its own, and its contacts see that one area and nothing else. The separation is not a matter of the interface — it sits in the data layer: every query is scoped to the company that follows from the signed-in session, never to one that arrived with a request.

The second sensitive point is the access tokens of the connected social media accounts. They are stored encrypted in the database, are decrypted on the server only and only immediately before the platform in question is called, and never reach the browser.

A separate area for every client company

A client login belongs to exactly one company. Whatever else is held in the application does not exist for that login.

A client company's login is tied to that company's area. Posts, media, comments, accounts and analytics belonging to other companies are neither visible nor retrievable through it.
The assignment is derived from the session on the server. An identifier passed in with the request changes nothing — the data layer provides no such route in the first place.
The on fleek team works across all the companies it serves, because it produces the content. Within the team, the right to manage client records and their portal users, to connect and disconnect social accounts, to use the AI features, to approve on the client's behalf or to archive and delete posts can be graded further.
If someone from the team temporarily takes on the view of a client login in order to help, the real identity behind it is written to the audit log.

Logins and signing in

on fleek creates the logins. There is no open self-registration — no page exists on which anyone could create an account for themselves.

A newly created account is not sent a password in plain text by email, but a signed sign-in link that is valid for that one account and expires. The user chooses the password.
Passwords must be at least ten characters long. Resetting works through a single-use, time-limited link sent to the address on file.
Agency logins can require a second step at sign-in: a code from an authenticator app, or alternatively a code by email, together with backup codes for emergencies.
When a login is suspended, the suspension applies to every further request — not only from the next sign-in onwards.

Platform access tokens

Connecting an Instagram, Facebook, TikTok or YouTube account produces an access token issued by that provider. We store no password belonging to the account holder, only this token — encrypted with AES-256-GCM, using a key that exists in the server environment alone.

Decryption happens on the server only, and only at the moment a call to the platform is due or a token is being refreshed. Tokens are never logged and never handed to the browser; no record that reaches the interface carries them. A key change is provided for: a stored previous key still allows older values to be read, while writing always uses the current one.

The connection status of every account is visible in the application — connected, expiring, disconnected or in error. When a connection runs out or is revoked by the account holder, the application reports it instead of passing over it silently.

Media

Images and videos are not left open on the internet. They are served through an endpoint that checks the sign-in on every single request.

Signed in, or not at all

The media storage is not publicly reachable. Every file passes through a proxy that verifies the session and matches the client company; videos are streamed through it. The responses are explicitly excluded from caching.

The exception when publishing

When publishing, Meta and TikTok fetch some media files themselves from a URL — for TikTok this concerns photo posts, videos are uploaded directly. For that, a freshly signed URL is generated per publishing attempt, valid for exactly one file and expiring after fifteen minutes. After that it leads nowhere.

Checked media

At upload the server reads every file itself: type, dimensions and duration come from the file, not from what the browser claims, and anything unreadable is rejected. Whether a file fits the chosen target type — format, aspect ratio, duration, size — is checked in the composer and again on the server before a post can be submitted for approval or approved, not first at publishing time.

Stored per client

Media, too, carry the client company they belong to. Retrieval through the proxy enforces the same separation as any other query.

Hosting and transport

Hosted in Germany: application, database and media storage run in an environment of their own, not in a shared multi-tenant system of a third-party provider.
The application is reachable over HTTPS only; browsers are pinned to it via HSTS.
Further protective headers prevent the application from being embedded in other sites and block access to camera, microphone and location.
No tracking takes place. The only cookies set are technically necessary ones: the session cookies for signing in and, inside the agency area, a cookie that remembers the client last selected. Fonts and all other assets come from our own servers.
The staging environment is separate from production and does not publish against real platform APIs at all.

The record: who approved what, and when

Publishing is a commitment we make to the client. That is why it stays traceable how a post got there.

Every status change of a post runs through a single, checked transition function and writes an entry to the audit log as it does so: who acted, whether as the agency, as the client company or as an automated job, when it happened, and which status followed which. Entries are only appended, never overwritten.

Publishing happens exclusively from an approved or scheduled post — the application holds no route around this state machine. The on fleek team sees the log entries in an activity view of its own, filtered by client and by the kind of actor. In addition, the application keeps the approval history per post, with comments, change requests and versions.

Disconnecting and deletion

An account holder can revoke the permission granted to on fleek Social at any time, directly with the platform. For Facebook and Instagram, Meta notifies us through a callback: the stored access tokens are deleted straight away and the connection is marked as disconnected. TikTok and YouTube send no such notification — there the application only notices when it next uses the token. For TikTok that is the hourly token run, which puts the connection into an error state; for YouTube it is the next publishing attempt at the latest, which then fails and is shown with the error returned by the platform.
When an account is disconnected inside the application, the associated tokens are deleted as well. Without a token the application publishes nothing further on that channel.
When work with a client company ends, its content, media and connections are deleted; statutory retention obligations remain unaffected.
Access to information and deletion can be requested at any time at info@agenturonfleek.com — by an account holder directly, too, without going through us as the agency.

Which data is processed for which purpose, how long it is kept and what rights data subjects have is set out in full in the privacy policy.

Questions about data and security?

on fleek GmbH · Industriestr. 10 · 92360 Mühlhausen · Germany. We answer questions about connected accounts, stored data and deletion ourselves.

info@agenturonfleek.com