# Security & Privacy


Social Neuron is built with security and privacy as core design principles.

## Authentication

- **OAuth 2.0** for all social platform connections -- we never store your social media passwords
- **API keys** prefixed with `snk_` for programmatic access, stored in your OS keychain
- **Row Level Security (RLS)** on all database tables -- users can only access their own data

## Data Protection

### Encryption
- All data in transit encrypted via TLS 1.3
- OAuth tokens encrypted at rest with AES-256
- API keys hashed with SHA-256 before storage

### Data Residency
- Application hosted on Vercel (edge network)
- Database on Supabase (AWS, configurable region)
- Media storage on Cloudflare R2 (global)

## Privacy Compliance

### GDPR
Social Neuron complies with the EU General Data Protection Regulation:

| Right | How to exercise |
|-------|----------------|
| Right to access | Settings > Account > Export Data |
| Right to erasure | Settings > Account > Delete Account |
| Right to portability | Settings > Account > Export Data (structured JSON) |
| Right to rectification | Edit your data directly in Settings |

### Data Processing
- We process your data to provide the service (GDPR Art. 6(1)(b))
- Analytics use hashed user IDs -- we never send raw identifiers to third parties
- We respect the Global Privacy Control (GPC) browser signal

### Cookie Policy
- **Essential cookies only** for unauthenticated visitors
- Analytics tracking requires explicit consent
- No third-party advertising cookies

## Third-Party Services

| Service | Purpose | Data shared |
|---------|---------|-------------|
| Supabase | Database, auth | Account data, content |
| Cloudflare R2 | Media storage | Uploaded files |
| Stripe | Payments | Email, subscription tier |
| PostHog | Product analytics | Hashed user ID, events |
| Sentry | Error tracking | Anonymized error data |
| AI providers | Content generation | Prompts (no PII sent) |

All third-party services are bound by data processing agreements.

## Reporting Security Issues

If you discover a security vulnerability, please email **socialneuronteam@gmail.com** with:
- Description of the vulnerability
- Steps to reproduce
- Impact assessment

We aim to acknowledge reports within 24 hours and resolve critical issues within 72 hours.