Encrypted transport
Soclo uses HTTPS/TLS for data moving between the app, the service and selected providers.
SecurityBusiness data deserves
Business data deserves
more than a badge row.
Soclo connects to valuable business systems. This page describes the current engineering practices and says plainly which certifications have not been completed.
Protected storage
Data is encrypted at rest where provided by the storage system; connected-account tokens receive separate protection.
Least privilege
Systems and people receive only the access needed for the task, with service roles kept away from public clients.
Revocable connections
Supported social and platform connections can be disconnected, removing Soclo’s stored access.
Protected editor preview
Customer websites are script-free. Signed-in tap-to-edit code exists only in an authenticated, nonce-bound sandboxed preview.
No invented certifications
Soclo does not display SOC 2, ISO or other audit badges until the certification is actually complete.
Responsible disclosure
Found a security problem?
Send the affected surface, clear reproduction steps and the potential impact. Do not include passwords, access tokens, private customer data or unnecessary personal information.
Email a security report →Website boundary
Public customer websites ship zero JavaScript.
Soclo-rendered public sites do not include scripts or inline event handlers. Interactive edit code is returned only to an authenticated owner session with a valid nonce, a restrictive content-security policy and a sandboxed frame.
A malformed or missing nonce receives the ordinary public document. The public address remains script-free even while the owner edits through the Soclo app.