Security

Your clients' content, kept private.

Agencies trust ContentPlus with unreleased campaigns and their clients' brands. Here is exactly how we protect that work — what we've built, and what our infrastructure providers handle.

Every agency's data is kept apart

Access rules are enforced inside the database itself (Postgres row-level security), on every table — not only in the app's screens.
Each agency can only read its own clients, content and files. Each client user can only see the brands they belong to.
Agency staff only see the clients and brands an admin has assigned to them.
These rules are covered by automated tests that try to read and change another agency's or client's data and must fail.

Role-based access

Agency roles (Owner, Admin, Staff and others) and client roles (Primary Owner, Admin, Approver, Viewer) each have a fixed set of permissions.
Only the people assigned to an approval step can approve at that step, and only while it is active. A step can't be skipped.
Only the client's Primary Owner can give the final approval. If they delegate it, the record shows who approved on their behalf.
Destructive actions, such as deleting a brand or removing staff, are limited to the agency Owner.

A permanent approval record

Every version of a post is kept. An approval is tied to the exact version the approver saw.
If a post changes after someone opens it, their approval is refused and they are shown the new version.
Approval decisions and the activity log are append-only: they can't be edited or deleted, only removed along with the whole agency account.
Double-clicks and retries are recognised, so the same decision is never recorded twice.

Private file storage

Uploaded images, videos and documents are stored in a private bucket. Nothing is publicly listed.
Files are shown through short-lived signed links that are created only after access has been checked.
Each file is stored under its agency and client, and upload rules check that path against the uploader's access.

Invitations and review links

Invitation and review links contain a long random token. Only a SHA-256 hash of the token is stored, so a database copy can't be turned back into working links.
Links expire, can be revoked, and are personal: forwarding a review link does not pass on approval rights.

Sign-in

Accounts are handled by Supabase Auth. Passwords are never stored in plain text — only a one-way hash.
Passwords must be at least 10 characters. Passwordless sign-in with a one-time email code is also available.
Signing in without an invitation doesn't give access to anything until an agency or client invites that email address.

Encryption

All traffic is served over HTTPS; plain HTTP is redirected, and browsers are told to use HTTPS only (HSTS).
Our database and file storage provider, Supabase, encrypts customer data at rest with AES-256 and in transit with TLS.
The app is hosted on Vercel, which serves every request over TLS 1.2 or 1.3.

In the browser

Pages can't be embedded in other websites, which protects against click-jacking.
Security headers block content-type sniffing, limit referrer information, and switch off camera, microphone and location access.
Video embeds use YouTube's privacy-enhanced mode.

Behind the scenes

The privileged database key is only ever used on the server, for background jobs like sending notifications — never in the browser.
Background jobs are protected by a secret and run on a schedule; each one is retried safely if it fails.
Our hosting providers, Vercel and Supabase, are independently audited for SOC 2 Type 2.

What we don't claim yet

ContentPlus itself has not yet been through an independent security audit or certification, and two-factor sign-in and single sign-on (SSO) are not available yet. We'll update this page as that changes.

Report a security issue

If you think you've found a vulnerability, please contact us with the details and steps to reproduce it. Please don't access other people's data or disrupt the service while testing.

ContentPlus is developed and owned by 1X1 Global (Pvt) Ltd.