Security at ContentVelo

Connections to our servers

Every request to a ContentVelo application is served over HTTPS. Requests that arrive over plain HTTP are redirected, and in production our servers send HTTP Strict Transport Security headers so that your browser will not fall back to plain HTTP afterwards. The exact TLS versions and cipher suites offered are a property of our hosting rather than of the application, so we do not name a version here that we cannot guarantee.

Requests that change something in your account carry an anti-forgery token, so another website cannot make your browser act on your account without your knowledge.

Accounts and signing in

You sign in with an email address and a password, or with a linked social account. A successful sign-in issues a session cookie that your browser will not expose to scripts and will not send to other sites.

• A client portal session lasts seven days and is extended each time you use it.
• An administration session lasts eight hours and is issued by a separate application with its own login.
• New email addresses are confirmed by a link sent to the address. Password resets use a single-use token that expires.
• ContentVelo does not currently offer two-factor authentication. Your password, or the social account you signed in with, is the only thing protecting your account.

How your password is stored

We do not store your password. We store a SHA-256 hash of it, and nobody at ContentVelo can read the password back out of that hash or will ever ask you for it.

We are saying plainly how that hash is computed, because it is below current practice and you are entitled to know before you choose a password. The same fixed value is added to every password rather than a different random value for each account, and the hash is computed once, with no deliberate slowdown. A modern password-hashing function such as bcrypt, scrypt or Argon2 does neither of those things, and moving to one is on our list of work.

What this means in practice: if our password table were ever exposed, common and re-used passwords would be recovered from it quickly. Please use a password you do not use anywhere else, and prefer a long one.

Facebook Pages and access tokens

Connecting a Facebook Page gives ContentVelo an access token issued by Meta. We store that token in our database so that scheduled posts can be published while you are away. It is stored in readable form: the application does not encrypt it, and its protection is the protection of the database and the server it runs on.

The token lets us read the Page's own posts and their engagement figures, and publish to the Page. It does not give us access to your personal Facebook profile, your friends, or any Page you have not connected.

Disconnecting a Page inside ContentVelo removes our copy of the token. It does not withdraw the permission you granted at Meta — that is done in your Facebook settings, under Business integrations. The data deletion page explains both steps. Delete Your Data

Payments

Card details never reach ContentVelo. Payment is taken on a page hosted by our payment provider, and we receive only the result: an amount, a currency, a status, the name of the payment method and the provider's reference numbers, which we keep so that we can show you your billing history. We send the provider your email address, the amount to be charged, an order reference and a short description of the plan you are buying, which is what it needs to raise the payment. We do not send your name: the form the product posts has no field for one.

Who else processes your data

Delivering ContentVelo means sending some of your data to other companies. These are the ones the product actually calls:

• OpenAI receives the instruction used to write a post. That instruction includes the description of your business, your tone and keyword settings, and — where you have entered them — the telephone number, email address, LINE ID, website and shop links you want to appear in posts. When you ask us to learn a Page's style, up to twenty of that Page's existing posts are sent as well.
• Google receives the instruction used to draw an image, through the Gemini API.
• Our payment provider receives your email address, the amount and an order reference, and takes the payment. It does not receive your name.
• Our image storage provider receives and hosts the images generated for you and the images you upload. Those files are served from a public web address that is not guessable but is not access-controlled either.
• Our outbound mail provider receives your email address and the content of the message whenever we send you a verification link, a password reset or a notification.

Cookie Policy

What we record about your use

Actions taken in your account are written to an audit log with the time, the action, your user and workspace, your IP address and your browser's user-agent string. Every generation request is written to a usage log with the instruction sent, the text and image produced, the model used, the cost, whether it succeeded, and the IP address it came from. These records exist so that billing can be explained and abuse investigated. They are kept for as long as the account exists: ContentVelo does not currently run a job that removes old log rows.

What we do not claim

A security page is only useful if its absences are as clear as its contents. As at the date above, ContentVelo does not have:

• an independent security certification or audit of any kind;
• application-level encryption of data at rest — whatever protection exists is provided by our database server and our hosting, not by ContentVelo's own code;
• two-factor authentication for customer or administrator accounts;
• a penetration test carried out by a third party, or a published bug bounty programme.

Where wording elsewhere on this site describes our security in stronger terms than this page does, this page is the current and accurate description.

Reporting a security problem

If you believe you have found a vulnerability in ContentVelo, write to us with enough detail to reproduce it. We will acknowledge your message. We do not offer a reward, and we ask that you give us a reasonable opportunity to fix the problem before describing it publicly.