Security

When you connect Instagram, Facebook, YouTube, TikTok or LinkedIn to Brooks, you’re trusting us with the ability to post for you. This page explains how we protect that access and your data.

Your social accounts

• Login tokens are encrypted. The token each network gives us is encrypted with AES-256-GCM before it’s stored. Each token is locked to its own account, so a copied database row can’t be used for any other account. The encryption keys are kept apart from the data.
• We never store your passwords. You sign in on the network’s own page, and we only receive a token.
• We ask for the narrowest permissions that let us post, and we never read your messages, comments, followers or analytics. (Meta’s Instagram login always includes a messaging permission; we never use it.) The full list is in our Privacy Policy.
• Connect flows are signed, so nobody can hijack a connection partway through.
• We verify every notice a network sends us (Meta’s signed requests, TikTok’s signatures and Google’s signed tokens) before acting on it.
• Access ends when you say so. When you disconnect an account in Brooks, we delete its token and revoke our access on the network where it allows it. When you remove Brooks on the network, or the network stops accepting our access, we stop posting to that account and delete its token.

Nothing posts without you

Every video waits for your approval. Brooks posts only what you approve, to the accounts you choose, with the settings you choose.

Where your data lives

• Brooks runs on Cloudflare, and our database is hosted by Neon in the United States.
• Every connection to Brooks uses HTTPS.
• Your face and voice are used only after you consent in Brooks, and we keep a record of that consent.
• Our other providers, and what each one does, are listed in our Privacy Policy.

Report a security problem

If you think you’ve found a security problem in Brooks, write to security@usebrooks.com. Please give us a reasonable chance to fix it before you share it publicly. We’ll reply, keep you updated, and thank you.