Security Statement

Social Covered Ltd ("Social Covered", "we", "our" or "us") is committed to protecting the confidentiality, integrity and availability of the information entrusted to us. This Security Statement provides an overview of the technical, organisational and operational measures we implement to safeguard our website, SC Hub, customer information and associated services. It should be read alongside our Privacy Policy and Terms & Conditions.

1. Encryption

• Data in transit: All data transmitted between your browser and our servers is encrypted using current industry-standard transport encryption protocols. This includes website traffic, SC Hub portal sessions, and API communications.
• Data at rest: All stored data — including account information, customer content, and platform data — is encrypted at rest using industry-standard encryption protocols on our cloud infrastructure.
• OAuth tokens: Social media authorisation tokens are encrypted and stored securely. They are only decrypted when needed to perform authorised actions on your behalf. OAuth credentials are accessible only by authorised application components when required to perform customer-authorised actions.

2. Authentication

• Password security: Passwords are stored using industry-standard one-way hashing (bcrypt). We never store plaintext passwords, and our staff cannot see your password.
• Session management: Portal sessions use secure, encrypted session tokens with automatic expiry. Sessions are invalidated on logout.
• Third-party login: When you use Facebook Login or Google Login, authentication is handled by the respective platform. We receive only the information you authorise (name and email) and never receive your Facebook or Google password.
• Additional authentication controls may be introduced over time, including multi-factor authentication where supported.

3. Role-Based Permissions

SC Hub uses role-based access control (RBAC) to ensure that users only access data and features appropriate to their role:

• Admin: Full access to portal settings, billing, team management, and all service data.
• User: Access to assigned workspaces, service requests, and content approval features.
• Team member: Access scoped to assigned tasks and deliverables within the portal.

Portal administrators control who is invited to the portal and what role each team member holds. Permissions are enforced at both the application and infrastructure levels and are reviewed periodically as the platform evolves.

4. OAuth Authentication

• Social Covered uses OAuth 2.0 for all third-party platform connections, including Facebook, Instagram (Meta), and Google.
• We request only the minimum scopes (permissions) required to deliver the services you have selected.
• No sensitive Facebook credentials stored: We do not store your Facebook password or any sensitive login credentials. We only store the encrypted OAuth access token granted by Meta, which allows us to perform authorised actions on your behalf.
• The same principle applies to Google and all other connected platforms — we never store your platform passwords.
• Customers remain in control of all authorisations and may revoke platform access at any time through SC Hub (where supported) or directly through the relevant provider.

5. Cloud Infrastructure

• Social Covered and SC Hub are hosted on secure cloud infrastructure designed with redundancy, resilience and availability in mind to support reliable service delivery.
• Infrastructure is configured with network segmentation, firewalls, and intrusion detection systems.
• Database access is restricted to authorised application services only; direct database access is not exposed to the internet.
• Security monitoring, vulnerability management and periodic security reviews are carried out as appropriate.

6. Payment Security

• All payments are processed by Stripe, a PCI-DSS Level 1 certified payment provider.
• We do not store, process, or transmit full card details — card data is tokenised and handled entirely by Stripe.
• Stripe's security controls are governed by their own compliance certifications and audits.

7. Data Separation

Customer data is logically separated within the platform using logical tenant separation, application-level isolation, permission enforcement and infrastructure controls. Each customer's portal, service requests, deliverables, and content are isolated so that data is only accessible to authorised users within the relevant account. Unauthorised cross-customer access is prevented by these layered controls.

8. Incident Response

Social Covered maintains an incident response plan to address security incidents. In the event of a confirmed data breach affecting your personal data, we will:

• Investigate and contain the incident as quickly as possible.
• Where required by applicable law, notify affected customers and the relevant supervisory authority without undue delay and within the legally required timeframes.
• Provide affected users with information about the nature of the breach and steps they can take to protect themselves.

9. Employee Access

Access to customer data is restricted to authorised Social Covered team members who require access to perform their role (e.g. content production, customer support, account management). All team members are subject to:

• Confidentiality agreements.
• Role-based access controls — no team member has blanket access to all customer data.
• Access is granted according to the principle of least privilege and reviewed according to operational requirements.
• Activity logging for sensitive actions performed within the platform.

10. Reporting Vulnerabilities

If you believe you have identified a security vulnerability in the Social Covered website or SC Hub platform, please report it responsibly to support@socialcovered.com with full details. We ask that you do not publicly disclose the vulnerability until we have had an opportunity to investigate and address it. We aim to acknowledge responsible disclosure reports within approximately 48 hours and provide updates on resolution where appropriate.

11. Continuous Improvement

Security is an ongoing process. Social Covered continually reviews and enhances its security controls, platform architecture, authentication mechanisms and operational procedures to respond to evolving threats, technology changes and customer requirements.

12. Shared Responsibility

Security is a shared responsibility. While Social Covered implements technical and organisational safeguards, customers are responsible for maintaining secure passwords, protecting access to their accounts, managing authorised users and reviewing connected platform permissions.

13. Contact

For security-related questions or concerns, please contact:

Social Covered Ltd — Security

Email: support@socialcovered.com

Website: https://socialcovered.com