What we protect, and how — stated plainly
Zybble handles your account, your drafts and a connection to your professional identity. This page describes, without marketing varnish, how that data is protected and what the LinkedIn integration can and cannot do.
No certifications or audits are claimed on this page — only practices that are true today.
Accounts and authentication
- Sign-in is handled by Supabase Auth: passwords are stored only as salted hashes, never in plaintext, and never by Zybble itself.
- Password resets and email verification use single-purpose, expiring links delivered to the address on the account.
- Session cookies are HTTP-only and scoped to the site; every private page is served with no-store so a shared or cached response can never show one person's workspace to another.
Your LinkedIn connection
- Zybble connects through LinkedIn's official OAuth flow. We never see, ask for or store your LinkedIn password.
- The access token LinkedIn returns is stored encrypted at rest and used only to publish the posts you scheduled and read the analytics LinkedIn returns.
- You can revoke Zybble's access at any time — from LinkedIn's own settings or from your Zybble workspace — and either action ends our access immediately.
Data isolation
- Workspace data lives in Postgres with row-level security: queries are scoped to your workspace at the database layer, not just in application code.
- Multi-tenant isolation is covered by automated tests that attempt cross-workspace reads and assert they fail.
- Drafts, scheduled posts and analytics are visible only inside your workspace. Team members see the workspace they belong to — nothing beyond it.
Operations
- The app runs on Vercel with a managed Postgres database. Transport is HTTPS-only, and browsers are told to remember that (HSTS) in production.
- Every response carries baseline hardening headers: nosniff, strict referrer policy, frame protections and a restrictive permissions policy.
- Private routes send explicit noindex headers as well as robots rules, and all API endpoints are rate-limited — most tightly where abuse would hurt most: authentication, OAuth and publishing.
People and access
- Zybble is a small product with a small surface: service-role database credentials exist only for background jobs and webhooks, never in browser code.
- Payment processing is handled by a third-party processor; Zybble does not store card numbers.
- No security certifications or audit reports are claimed here — what is described on this page is what the system actually does today.
Reporting a security concern
If you have found a vulnerability or see something that looks wrong, tell us: tejassutar.business@gmail.com — or through the contact form with the topic set to Security. Describe what you found and how to reproduce it; every report gets a considered reply. Please give us a reasonable window to fix issues before public disclosure, and do not test against accounts or data that are not yours.
Questions about how your data is used rather than how it is protected? That is our privacy policy.
Your next LinkedIn post is already written. Schedule it.
Join the free plan, connect LinkedIn and put your next ten posts on the calendar — in under fifteen minutes.
Free plan · No credit card · Cancel anytime