Security

Security and Data Protection

Security-control framework, credential-handling commitments, logging practices, backups, and incident-response expectations.

Last updated: 12 September 2026

On this page

Postaryx is operated by Lunark Dynamics LLC. We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and loss.

This page describes the measures that are in place today. We are an early-stage company and our security programme will develop as the Service does. Where a specific control is required by a contract or by a platform's developer terms, we will meet that requirement before enabling the relevant functionality.

Security is an ongoing programme rather than a guarantee of absolute protection. No internet service is completely secure, and we cannot promise that unauthorized third parties will never defeat our safeguards.

Encryption in transit. Traffic between your browser and the Service is encrypted using TLS.

Password storage. Account passwords are stored as salted hashes and are never held in a readable form. We cannot recover your password, only help you reset it.

Access control within the product. What a person can see and do in a Workspace is determined by their assigned role and the permissions attached to it. Requests are scoped to the Workspace they belong to, so one Workspace cannot read another Workspace's data.

Credential encryption where it applies. Customer-supplied API keys, application passwords, per-instance connection credentials, and the client secrets of applications registered against Postaryx are encrypted before they are stored.

Credential removal on disconnect. When you disconnect a Connected Platform, the stored access token, refresh token, and expiry for that connection are erased from our live systems as part of the same operation. Where a platform offers a revocation method that Postaryx supports, we also ask the platform to invalidate the authorization.

Secrets kept out of logs. Tokens, keys, and other credentials are excluded from application logs and error reports.

Upload validation. Files you upload are checked against their actual content rather than their claimed file type, and only permitted media types are accepted.

Backups. Postaryx may maintain backups according to infrastructure configuration and operational requirements.

OAuth tokens, refresh tokens, platform application secrets, customer API keys, application passwords, bot tokens, database credentials, and signing secrets are treated as high-risk data. Our practices are to:

  • keep raw secrets out of logs, analytics events, error traces, support exports, and responses sent to the browser;
  • limit access to secrets to the systems and people that need it;
  • rotate or revoke a secret after suspected compromise and in line with the relevant provider's guidance;
  • delete customer-supplied credentials when the related connection is removed; and
  • use separate credentials for production and non-production environments.

We would rather tell you what is missing than imply a control we have not built. As of the last-updated date above:

  • Postaryx does not offer multi-factor authentication on accounts.
  • Platform OAuth access and refresh tokens are protected by access control rather than by encryption at rest while a connection is active. They are erased when you disconnect the connection.
  • Sessions do not expire automatically on a fixed schedule, and signing out clears the session in your browser rather than invalidating it everywhere.
  • Automatic revocation of a platform authorization on disconnect is available only for the platforms that offer a revocation method Postaryx supports. For other platforms, revoke Postaryx from that platform's own application-permissions settings.
  • Account deletion is handled as a verified request to our support address rather than as a self-service control in the product. See the Data Deletion Instructions.

If any of these matters to your use of Postaryx, contact us at before you rely on the Service for that purpose.

We record the operational and security events needed to investigate failures, prevent abuse, and support customers, while avoiding keeping an unnecessary copy of User Content or credentials. Log retention is determined by our infrastructure configuration.

Where a monitoring or error-reporting vendor receives personal data, that vendor is listed in the Subprocessor section of our Privacy Policy.

If we become aware of a security incident affecting personal data, we will investigate it, take steps to contain and remediate it, and assess what notification is required. Where applicable law or a contract requires us to notify you or a regulator, we will do so within the period that law or contract requires.

To report a suspected vulnerability or security incident, email with enough detail for us to reproduce the issue. We will acknowledge your report and will not pursue action against good-faith security research that respects user privacy and avoids service disruption.

Security is shared. You are responsible for your own devices, your Account credentials, the roles you assign inside your Workspace, the Connected Platform accounts you authorize, and any data you export from Postaryx.

Postaryx cannot protect a platform account after its credentials have been disclosed, or after someone has been given Workspace access they should not have. Review your Workspace members and your connected accounts periodically, and remove access that is no longer needed.

Security reports and questions:

Legal notices: