Sections 8–16 describe representative hosting and operational practices for the Social Tycoon platform and are provided for informational purposes. Specific controls may evolve as we improve our program.
Security is foundational to Social Tycoon. Because every network we host runs on shared, multi-tenant infrastructure, protecting customer data is core to our product — not an afterthought. This overview summarizes the technical and organizational measures we use. It complements our Privacy Policy and Data Processing Agreement.
01Our approach
We follow defense-in-depth and least-privilege principles, and design with security and privacy in mind from the start. Business rules — visibility, counters, notifications, moderation and limits — live in one shared core, so the web app, the admin console and the native apps all enforce the same ones.
02Accounts and sessions
- “Forgot password?” sends a single-use link valid for one hour. Only a hash of the token is stored, a member can request at most three an hour, and the answer never reveals whether an account exists.
- Using a reset link signs the member out of every app and every browser. Changing a password signs out their other browsers.
- Browser sessions carry a fingerprint of the password hash, so an old session can’t outlive a password change.
- When email is really sent, one-time tokens are redacted from the stored copy.
03Admin access
- Admins have roles, and each role has its own permission set; the super-admin role is protected.
- Admin forms are protected against cross-site request forgery, and admin actions are recorded in an audit log.
- Payment secrets are masked on screen and never echoed back, in the console or the API.
04Payments
- Stripe webhooks are signature-verified; each event is processed once and each payment is fulfilled exactly once.
- Everything an install creates in Stripe carries that install’s id, so networks sharing a Stripe account never credit each other’s members, and events from the wrong mode (test or live) are ignored.
- The native apps open checkout in the browser rather than handling card details themselves.
05Files and uploads
- Code can’t run from the uploads folder.
- Résumé files are stored outside the web root and sent only to their owner and to the Pages they were sent to.
- Deleting a post releases its files once nothing else uses them; an admin can purge a file everywhere.
06Privacy in the product
- Private accounts share only with approved followers, friends or connections — an unanswered request never unlocks anything.
- Advertising audience estimates never give an exact count below 20 people, and keyword targeting reads public posts only.
- “Why am I seeing this ad?” answers only for an ad the member was actually shown.
07Account deletion
Deleting an account removes the member and everything they made or run — posts, comments, reactions, stories, messages, Pages, groups, events, jobs and uploads — and recomputes every counter. Their Stripe subscriptions are cancelled first; if Stripe can’t confirm it, nothing is deleted and the reason is shown. Money records stay.
08Infrastructure & hosting
The Service runs on reputable cloud providers operating data centers with strong physical and environmental controls and recognized certifications. Tenants are logically isolated, environments are segmented, and infrastructure is provisioned through reviewed, version-controlled configuration.
09Encryption
Data is encrypted in transit using TLS and at rest using strong, industry-standard algorithms. Encryption keys are managed through a dedicated key management service with restricted access.
10Access controls
Access to production systems is restricted to authorized personnel on a need-to-know basis, protected by single sign-on, multi-factor authentication and role-based permissions. Access is logged and reviewed, and revoked promptly when no longer required.
11Application security
We follow secure development practices, including code review, dependency management and automated testing. We use protections against common web vulnerabilities (such as the OWASP Top 10) and perform vulnerability scanning, with periodic penetration testing by qualified third parties.
12Monitoring & logging
We monitor systems for availability and suspicious activity, centralize logs, and maintain alerting and an incident response process to detect, investigate and respond to security events in a timely manner.
13Backups & resilience
Data is backed up regularly, and backups are encrypted and tested. We design for high availability with redundancy across components, and maintain business continuity and disaster recovery plans aligned to our SLA.
14Data protection
We process personal data in line with our Privacy Policy and, where we act as processor, our DPA. Customers control retention settings, and we provide export and deletion tooling to help you meet your obligations.
15Compliance
Our practices are designed to support customer compliance with frameworks such as GDPR and CCPA. We provide tooling, contractual commitments and documentation to assist your own assessments. Available certifications and reports can be shared with qualified customers under NDA.
16Responsible disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability, please send details through the contact form (or call 0745.393.778), with details and steps to reproduce. Please act in good faith, avoid privacy violations and service disruption, and give us reasonable time to respond before any public disclosure.
17Contact
Questions about this document? Call 0745.393.778, use the contact form or write to Social Tycoon, 2261 Market Street, Suite 5520, San Francisco, CA 94114.