Security
How we protect your data, what we do when something goes wrong, and how to report a vulnerability. This document is meant to be read in advance: by you, by your IT person, or by someone who found something. The Dutch version is the binding one.
The principles
Keep as little as possible. What is not there cannot leak. We do not ask for data we do not need and keep nothing longer than the purpose we hold it for.
A workspace is a boundary. Every request is checked against workspace and role; there is no screen where another client's data could appear by accident.
A key you give us is yours. Keys for Odoo, Meta, Google or your social channels are stored encrypted, never shown back, never written to a log line and never sent to an AI model.
Administrator access is temporary and leaves a trail. There is no permanent administrator session in a client environment.
Access
Account sign-in uses Google Firebase. Enforcement of two-step verification depends on the sign-in route and account policy. The central administration portal supports passkeys and a time-based code. This does not guarantee a second factor for every direct app sign-in.
When an administrator opens a client environment, it happens with a token valid for two minutes that opens that one system only and that is judged by that system itself. The token never appears in a log; its issuance does, with who, which system and when.
Rights are granted per workspace. When someone leaves, their access is withdrawn; in the OS you do that yourself under Team.
Encryption
All traffic runs over TLS. Anyone arriving over http is redirected to https.
Data is stored encrypted at our providers.
Secrets live only in the hosting provider's environment. They are not in the source code and not in a configuration file that travels in version control.
The software itself
All code is under version control. Every deployment traces back to a commit and can be rolled back.
An automated test suite of more than two thousand tests runs before every deployment. A failing suite means no deployment.
A strict Content Security Policy determines which scripts, styles and connections a page may use. A script of unknown origin does not run, even if it found its way in.
Dependencies are checked for known vulnerabilities. A vulnerability of high severity or above blocks deployment until it is resolved.
Monitoring
Consequential actions — granting access, opening a system, changing a key — are recorded in an audit trail.
Errors and warnings are collected centrally. Personal data is not written into them.
The reachability and login protection of every client system is checked automatically and continuously. If a system serves its home page without a login, that appears as an alarm on the administration screen.
If something does go wrong
We notify the client concerned of a personal data breach within 24 hours of discovery, with what happened, what it likely affects, what we have done and where to reach us. That is shorter than the 72 hours the GDPR gives you, so you can make your own assessment with time to spare.
We keep a register of breaches, including those that did not have to be notified.
We do not notify the supervisory authority on your behalf unless you ask us in writing. You are the controller; that notification is your decision.
Reporting a vulnerability
If you find something, report it to security@socialnow.nl, or read https://socialnow.nl/security.txt first. Describe what you found, where, and how it can be demonstrated. A screenshot or a short set of steps helps.
What you may expect from us: a reply from a person within three working days, an assessment of severity within ten working days, and word when it is fixed. If you report responsibly and do not abuse what you found, we will not report you to the police and will not hold you liable. If you want to be credited in the fix, we are happy to.
What we ask of you: do not view, copy, alter or delete other people's data; do not take a service down; no social engineering, phishing or physical access; no automated scanning that loads the system; and do not share the flaw before it is fixed. If you unintentionally reach other people's data, stop and say so in your report.
We do not pay a bounty. What we do is answer fast and fix fast.
What we do not do
We hold no ISO 27001 or SOC 2 certification. SocialNow is a small company; such a certification says more about the budget for auditors right now than about the security itself. What we do do is written above, and Annex B of the data processing agreement sets it out as a list you can walk through.
We have no back door into a client system. Access always runs through the short-lived token that the client system judges itself.
Contact
Vulnerabilities: security@socialnow.nl. Privacy and data: privacy@socialnow.nl. Everything else: hello@socialnow.nl.