Security & Trust Center

Last Updated: August 27, 2026

At Praffer (Turca LLC), the security of your business, audience data, and social media channels is our highest priority. We engineer our platform with defense-in-depth principles, enterprise-grade encryption, and strict multi-tenant isolation.

1. Authentication & Social Media Authorization

• Zero Social Media Password Storage: Praffer NEVER sees, requests, or stores your social media account passwords. All integrations (Instagram, Facebook, LinkedIn, YouTube, TikTok, Canva, Google Drive, Dropbox) are established using official OAuth 2.0 authorization workflows directly on the respective platforms.
• AES-256-GCM Encryption at Rest: All OAuth access and refresh tokens are encrypted using military-grade AES-256-GCM before being committed to our database.
• Two-Factor Authentication (2FA): Time-based One-Time Password (TOTP) 2FA support to protect team accounts against unauthorized access.
• Session Security: Authentication tokens utilize hardened HttpOnly, Secure, and SameSite=Lax cookie flags, fully mitigating client-side script theft (XSS session hijacking).

2. Data Isolation & Multi-Tenancy

• Tenant Boundary Enforcement: Every workspace operates in strict logical isolation. All database queries, server actions, and background publishing tasks enforce workspace ID tenancy constraints, preventing Insecure Direct Object References (IDOR).
• Role-Based Access Control (RBAC): Granular permissions (Owner, Admin, Editor, Contributor, Viewer) ensure team members only access what they are explicitly authorized to manage.

3. Payment & Financial Security

• Zero Card Data Handling: Praffer does NOT collect, store, or process payment card numbers or CVVs on our infrastructure.
• PCI-DSS Level 1 Infrastructure: All billing, recurring subscriptions, and payment methods are securely handled via Stripe, certified to PCI-DSS Level 1 (the highest standard in global payment security).

4. Infrastructure & Network Defense

• Cloudflare Web Application Firewall (WAF) & DDoS Shield: All inbound HTTP traffic is routed through Cloudflare's global edge network, providing automatic DDoS mitigation, suspicious IP blacklisting, and rate limiting.
• End-to-End TLS 1.3 & HSTS: Forced HTTPS encryption with strict HTTP Strict Transport Security (HSTS preload, 2-year max-age) and hardened security headers (X-Frame-Options, X-Content-Type-Options: nosniff, Content-Security-Policy).
• Isolated Asynchronous Processing: Scheduled posts and background jobs run on dedicated worker queues (BullMQ/Redis) isolated from the primary web application.

5. Compliance, Privacy & Vulnerability Disclosure

• GDPR & KVKK Compliant: We strictly adhere to the EU General Data Protection Regulation (GDPR) and Turkish KVKK standards. Data deletion requests are processed in full compliance via our Data Deletion page.
• RFC 9116 Security Policy: We maintain a machine-readable security policy at /.well-known/security.txt.
• Responsible Disclosure: If you discover a vulnerability or security issue, please contact us immediately at [email protected]. We respond to verified vulnerability submissions promptly.