Your Data Security is
Our Priority
Here is how POSCOS protects your business data, connected social media accounts and customer information.
Comprehensive Security Features
Multiple layers of protection for your peace of mind
Encryption in Transit
All data sent between your devices and our servers is encrypted with HTTPS (TLS).
- TLS 1.2 / 1.3 encryption
- Perfect forward secrecy
- HTTPS on every page and API
Secure Data Storage
Your data is stored in a managed cloud database that is encrypted at rest. Login tokens for connected social media accounts are encrypted again separately.
- AES-256 encryption at rest
- Social media tokens encrypted with AES-256-GCM
- Passwords stored as irreversible hashes
Two-Factor Authentication
Add an extra layer of security to your account with 2FA using an authenticator app or email codes.
- Authenticator app (TOTP) support
- Email verification codes
- Backup recovery codes
Role-Based Access Control
Control who can see and do what, with separate roles for your team members.
- Admin, staff and viewer roles
- Per-store access for staff
- Admins manage team access
Audit Logs
Track key actions in your account with audit logs for security monitoring.
- User activity tracking
- Login history and IP logs
- Team member action logs
- Export audit logs as CSV
Privacy Protection
We never sell your data. Your content and customer information remain private and under your control.
- GDPR compliant
- No data selling
- Right to deletion
Infrastructure Security
Our servers are hosted in Japan, serve traffic over HTTPS only, and limit request rates to protect against abuse.
- Request rate limiting
- Health-checked deployments
- Instant rollback of a bad release
Secure Email System
All system emails are logged, monitored, and encrypted. Complete transparency for security-critical communications.
- Email delivery logs
- Failed email alerts
- Email archive system
- Delivery status tracking
Security Best Practices
How we protect your data every day
Vulnerability Management
- Vulnerability reports accepted through our contact address
- Fixes released as soon as issues are confirmed
- Security headers on all responses
Employee Security
- Background checks for all employees
Incident Response
- Affected users notified by email within 72 hours of a confirmed breach
- Releases can be rolled back immediately
Application Security
- Input validation and sanitization
- Protection against injection and cross-site scripting
- Rate limiting on login and sign-up
- Credentials never sent to the browser
Data Protection FAQ
Common questions about your data security
Where is my data stored?
Your data is stored in secure, enterprise-grade data centers located in Japan and the US. All data centers meet international security standards and are equipped with physical security, fire suppression, and redundant power systems.
Who has access to my data?
Only you and your authorized team members have access to your data. POSCOS employees have strictly limited access on a need-to-know basis for support purposes only, and all access is logged.
How long do you retain my data?
Active account data is retained as long as your account is active. Upon account deletion, all data is permanently removed within 30 days. Backup copies are retained for 90 days for disaster recovery purposes.
Can I export my data?
Yes. Analytics reports can be downloaded as Excel or CSV at any time, and you can request an export of your account data from your settings. We'll email you when it's ready.
What happens if there's a security breach?
In the unlikely event of a breach, we will notify affected users within 72 hours via email and provide detailed information about the incident and remediation steps.
Do you provide audit logs and activity tracking?
Yes, POSCOS provides comprehensive audit logs that track all user activities, login attempts, team member actions, and system changes. Logs include timestamps, IP addresses, and detailed action descriptions. Audit logs can be viewed in your dashboard and exported for compliance purposes.
How do you secure email communications?
All system emails (password resets, security alerts, verification emails, etc.) are logged with complete delivery tracking. We monitor email delivery status, log failed attempts, and maintain a searchable archive. Administrators can view email logs by type, status, and recipient for security auditing. All emails are sent via encrypted SMTP with TLS.
Security & Vulnerability Contact
Questions about our security practices or security features
Report a security vulnerability to us
Request more detail about how we protect your data
Response Time
Security Inquiries
24 hours
Critical Vulnerabilities
4 hours
Security Information
Contact us for more detail about our security measures.