Security at GetMulticast

Infrastructure

• GetMulticast runs on Google Cloud (Firebase, Cloud Functions, Firestore, Cloud Storage), in Google's data centres, which hold SOC 1/2/3, ISO 27001 and other certifications.
• All traffic uses HTTPS (TLS 1.2+). Data is encrypted at rest by Google Cloud (AES-256).
• Servers are managed by Google — there are no machines we patch by hand. Our code runs in isolated, automatically updated containers.

Your social accounts

• We connect through each platform's official login (OAuth). We never see or store your social media passwords.
• Login tokens are stored only on our servers and are never sent to your browser. You can disconnect any account at any time, and you can also remove access from the platform's own settings.
• We ask only for the permissions a feature needs, and each connect screen lists them.

Access control

• Team roles: Owner, Admin, Approver, Editor, Contributor and Viewer, plus per-person limits on which apps someone may post to.
• Approvals: posts can require one or two approvals before they go out, and nobody can approve their own post.
• Single sign-on (SSO): teams can sign in through Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 / OIDC provider, and can require SSO for their company domain.
• Our database denies all direct access by default; every read and write goes through checked server functions.
• Inside our company, production access is limited to the people who need it, protected by Google accounts with 2-step verification.

Audit logs

• Every important action — publishing, scheduling, approvals, role changes, connected accounts, API keys, sign-ins and payments — is recorded in an activity log with who, what, when and from which IP.
• Team owners and admins can view and download it (CSV) from Settings. Entries are kept for 400 days.

Monitoring and incident response

• Errors, failed logins to platforms, payment problems and unusual activity create real-time alerts to our team.
• If a security incident affects your data, we will tell you without undue delay — within 72 hours of confirming it — with what happened and what we're doing.

Payments

Card payments are handled by Razorpay and Stripe (both PCI-DSS Level 1). Card numbers never touch our servers.

Data retention and deletion

• You can delete posts, disconnect accounts and delete your account. When you delete your account we remove your data from our live systems; backups expire on Google Cloud's normal schedule.
• Login location records are kept for 90 days; activity logs for 400 days.

Service providers we use

Google Cloud / Firebase (hosting, database, login), Razorpay and Stripe (payments), Brevo (email), Slack (internal alerts), and AI model providers used only when you ask for AI captions, images or videos. See our Privacy Policy for details.

Compliance

We follow the security practices that SOC 2 is built on — access control, change review, logging, monitoring, incident response and vendor review — and we are preparing for a formal audit. We are not yet SOC 2 certified. Enterprise customers can request our security questionnaire answers at support@getmulticast.com.

Contact

CloudWeb Technologies Private Limited · support@getmulticast.com