You hand Postfjord the keys to your social accounts, your customer list and your email. This page says how we protect them, in plain words. Where you can check a point yourself, we say how.
We do not hold a SOC 2 or ISO 27001 certificate. What we do have is below.
Your data
Where it lives. The database, your files and our servers run on Google Cloud in Belgium (europe-west1). Email you send with Postfjord goes out through Amazon's email service in Stockholm. A few services we use can handle data in the USA, like the AI that writes drafts and Stripe for payments. Our privacy policy lists every one of them, what each one does and where.
Encrypted on the way. The app, the site and your pages only answer over HTTPS, with TLS 1.2 or 1.3. Older versions are refused.
Encrypted on disk. Google encrypts everything we store. On top of that, the keys that let Postfjord post to your social accounts, and the Stripe, AI and booking keys you paste in, are encrypted again with our own key (AES-256-GCM) before they are saved. That key lives in Google's Secret Manager, and only our servers can read it.
Things we never store. Your password is held by Google's sign-in service, Firebase Authentication, and we never see it. Your card number goes to Stripe. Your Postfjord API keys are shown once, and we keep only a one-way fingerprint of each.
What our team can see. Our admin tools show workspace names, plans and counts, never a token or a password. To look inside a workspace, for example to help with a problem, a Postfjord admin has to join it. Every owner of the workspace gets an email when that happens, and the join is written to our admin log, which we keep for 13 months.
Deleting. You can delete a workspace or your whole account yourself, under Settings. It happens right away: posts, contacts, files and channel keys go with it, and Postfjord's webhooks are removed from any Stripe, Shopify or booking account you connected. Copies in our backups expire on their own. If you disconnect one channel, its key is deleted at once.
Your account
- Passwords need at least 10 characters. We refuse the most common ones, and any password that has shown up in a known data leak. That check sends only the first 5 characters of a scrambled copy to the leak list, never the password.
- Two-step verification with an authenticator app is there for every account, with 10 recovery codes for a lost phone. We store the recovery codes only as fingerprints.
- Passkeys let you sign in with Face ID, Touch ID or your device PIN.
- New sign-in alerts. Once your account is a few days old, a sign-in from a new device in the app sends you an email. The email has a "This was not me" link that signs you out everywhere and sends you a link to set a new password.
- Sign out everywhere is one button under Account. It also cancels your API keys and AI app connections.
- Resetting your password signs out your other devices, removes your passkeys and cancels your API keys.
- Sensitive changes ask again. If your last sign-in was more than 10 minutes ago, Postfjord asks you to sign in again before you make an API key, connect an AI app, Stripe or Shopify, invite someone, change a role, or delete a workspace or your account.
Inside the app
Each workspace is closed off. Every read and write in the database goes through access rules that check you are a member of that workspace. The rules have their own automated tests: 42 test files sign in to a test copy of the database as different roles, and as strangers, and check what each one can and cannot do.
Roles. A workspace has owners, editors and viewers. Viewers see posts and results. They do not see your customers: messages, comments, email subscribers, bookings and sales are closed to them by the same rules.
Secrets stay on the server. Channel keys, API key fingerprints, connected app secrets and our admin log are in places no browser or app can read at all. Only our servers can.
API keys and AI apps. Each API key belongs to one workspace and has one level: read, draft or publish. AI apps like ChatGPT and Claude connect with the standard OAuth sign-in and PKCE. Only an owner can approve one, and the approval screen shows the app's real name. You can cancel a key or an app at any time.
Links and websites we fetch. When Postfjord reads a website you typed in, it refuses private and internal addresses, checks every redirect, and connects only to the address it checked.
Webhooks. Messages from Meta, Stripe, Shopify, Amazon and booking tools are checked for the sender's signature or secret before we store anything.
Pages on postfjord.page run no scripts at all. Their security header allows none.
Stopping a workspace. If a workspace is used for abuse, we can suspend it. From that moment it cannot publish, send email or messages, use the API or connect new accounts.
Email you send
Postfjord sends your email from a shared address at mail.postfjord.com until you add your own domain.
- Signed and checked. Every email is signed with DKIM. A domain you add gets 2048-bit DKIM keys, and can get its own bounce address so SPF passes too.
- Spoofing is blocked. Our domains publish a DMARC policy of reject, so mail servers throw away email that pretends to be from us.
- Mail to us is encrypted. postfjord.com publishes an MTA-STS policy and TLS reporting, so other mail servers only hand mail to us over an encrypted connection, and we get a daily report if one fails. It runs in testing mode until we have two weeks of clean reports, then we enforce it.
- Your reputation is your own. Each workspace sends under its own reputation at Amazon. One workspace with bad lists does not slow down yours.
- Bounces and complaints. An address that bounces or marks you as spam is never emailed again. Once 200 emails of a campaign are out, it pauses by itself if bounces pass 3% or spam complaints pass 0.2%.
- Links are checked before sending. Every link in an email is checked against Google Web Risk, the list of known phishing and malware sites behind Chrome's warnings. A flagged link stops the email until you remove it.
- Easy to leave. Campaigns and automated emails carry an unsubscribe link and the one-click unsubscribe button that Gmail and Apple Mail show. People who sign up through your forms confirm their address first.
Our domains from the outside
Anyone can check these. The commands are in brackets.
| What | postfjord.com | postfjord.page |
|---|---|---|
DNSSEC: answers about our domain are signed, so nobody can fake them (dig +dnssec postfjord.com) | On | On |
CAA: only named certificate authorities may issue our certificates (dig CAA postfjord.com) | On | On |
| HTTPS only, and browsers are told never to try anything else (HSTS, on the browser preload list) | On | On |
| TLS 1.0 and 1.1 refused | Yes | Yes |
| DMARC policy for email | Reject | Reject, and no mail is sent from it |
MTA-STS and TLS reporting for mail to us (dig TXT _mta-sts.postfjord.com) | On, testing mode | No mail is received |
| UpGuard security rating | A, 943 of 950 | A, 936 of 950 |
The UpGuard ratings were taken in October 2026. The postfjord.page scan ran before its DNSSEC and CAA records were visible to scanners. You can run the same check yourself at UpGuard.
Our sites also send the headers browsers use to block common attacks. A content security policy lists where code may load from, so a script slipped into a post or a name would not run. The app cannot be shown inside another website, which stops pages that dress it up to trick you into clicking.
Payments
Payments go through Stripe Checkout. Your card details go to Stripe and never reach Postfjord. Stripe is certified PCI DSS Level 1.
If you connect your own Stripe account to count sales, we ask for a restricted key with a single permission. We refuse a full secret key.
How we work
- Changes to our servers and database rules get a code review and a run of the automated tests before they go out. The tests use a test copy of the database and never touch real data.
- Backups. We can restore the database to any minute of the last 7 days. We also take a daily backup kept 7 days, and a weekly one kept 12 weeks. On 12 October 2026 we restored a full backup as a drill. It took about 10 minutes. Every Sunday a copy of the whole database also goes outside Google Cloud, to Cloudflare R2 in the EU. Each copy is checked file by file, locked so nobody can change or delete it for 81 days, and deleted after 82 days.
- Admin access needs two-step verification with an authenticator app.
- Status. Our status page checks the app, publishing and email every minute.
- If something goes wrong. We have a written plan for incidents. If a problem affects your data, we tell you without undue delay, and where we can within 48 hours, as our data processing agreement says.
Found a problem?
Write to security [at] postfjord.com and tell us what you found, with the steps to see it. This is what you can count on:
- We answer within 3 working days.
- We tell you what we will do and keep you posted until it is fixed.
- We will not take legal action against you for research done in good faith: you only test against your own account and data, you do not read, change or delete other people's data, you do not slow the service down for others, and you give us a fair chance to fix the problem before you tell anyone else.
Out of scope: spam to our forms, missing headers with no real effect, and attacks on the services we use (Google Cloud, Amazon, Stripe, Cloudflare). Report those to them. The same address is in our security.txt.
FAQ
Where is my data stored?
On Google Cloud in Belgium, and emails go out from Amazon in Stockholm. Some services we use, like AI drafts and payments, can handle data in the USA. The privacy policy lists them.
Can Postfjord read my password?
No. Passwords are handled by Firebase Authentication from Google, and we never see them.
Can Postfjord staff see my workspace?
Only after a Postfjord admin joins it. Every owner gets an email when that happens, and it is logged.
What happens to my social media accounts if I leave?
When you disconnect a channel or delete your account, the key that lets Postfjord post for you is deleted.
Is Postfjord SOC 2 or ISO 27001 certified?
No. This page describes what we have in place today. Card payments are handled by Stripe, which is PCI DSS Level 1 certified.