Security
The most valuable thing a publishing tool holds is a pile of other people's access tokens. That is why a single breach at a scheduling vendor in 2013 spammed thirty thousand accounts, and why token theft from software-as-a-service vendors is still the pattern in 2026. Xairo is built so there is no pile.
Where your tokens live
In your operating system's keychain: Credential Manager on Windows, Keychain on macOS, the Secret Service on Linux. The desktop app puts them there and reads them back when it publishes. They are never sent to us, never written to our database, never cached and never logged. If our servers were taken tomorrow, no one could post as you.
How sign-in works without us holding a secret
Networks require an approved application to hold a client secret, which is why bring-your-own credentials is such a chore. Xairo holds one reviewed application per network. When you press Connect, our service starts the sign-in, you approve on the network's own page, and the code comes back to the app. The app hands that code to our service, which exchanges it using the client secret and returns the tokens in that one response. The service keeps nothing.
What the cloud does hold
- An account for each install, created when the app first opens. It has no email address until you add one by signing in on this site.
- Session and device tokens, and the identifier each install keeps in your keychain, stored only as SHA-256 hashes with a server-side pepper. A database copy cannot be replayed.
- Sign-in codes, also hashed, for fifteen minutes, with a five-attempt limit.
- Which networks you connected and the handle on each, so the portal can list them and so we can honour deletion requests from the network's side.
- How many credits each publish used.
- Your plan and a Polar customer identifier.
Database isolation
Every request runs inside a transaction as a role that owns nothing and cannot bypass row-level security, with your account identifier set for the life of that transaction. Postgres policies then decide what is visible. A query that names another account's rows directly returns nothing, and the test suite proves exactly that on every run rather than trusting the application code to remember. Operator data such as plan prices and network limits is read-only to the running service.
Transport and infrastructure
Everything is HTTPS with certificates managed by our host. The database is a managed Postgres instance with daily backups, reachable only over TLS. The credit ledger is append-only. Secrets including the network client secrets, the session pepper and the Stripe keys are stored as sealed environment variables and are never committed to the repository.
Logging
One structured line per request: a request identifier, method, path, status, duration and the account identifier where authenticated. Never a token, never a sign-in code, never a request body, never the contents of a post. Vendor errors are recorded by status and message only, with the request stripped out.
What we have not done yet
Xairo does not hold a SOC 2 report or an ISO 27001 certificate. Neither do most tools in this category, but we would rather say so than let the absence imply otherwise. There is no single-sign-on and no hardware-key second factor yet. The app needs no sign-in at all: it identifies itself with a secret held in your operating system keychain. Signing in on this site is an emailed code, which removes passwords as an attack surface but is not phishing-proof. Both are on the roadmap and this page will change when they land.
Reporting a vulnerability
Email security@xairoapp.com. We acknowledge within two business days and will keep you updated until it is fixed. Please do not test against accounts that are not yours. We will not pursue anyone who reports in good faith and gives us a reasonable window before publishing.