Features — Accounts and security
How postfast holds your credentials
Publishing on your behalf means holding tokens that can post as you. This page says exactly how they are stored, what is never returned, and how you take them back.
The credentials are the product’s real liability
A scheduler holds tokens that can post as you. Everything else about its security posture is secondary to how it stores those and who can read them back.
In postfast every platform credential — access tokens, refresh tokens, Bluesky sessions, and even the client secret a Mastodon instance issues — is encrypted at rest under the application secret and opened only in memory to sign a call. No endpoint returns a credential, in any shape, to any caller. Not to the portal, not to the mobile app, not to you.
Signing in
- Email and password, Google, or Apple. Whichever you prefer. Social sign-in does not create a second kind of account.
- Verified email, and it is gating. An unverified address does not get to use the product. Verification is a gate rather than a badge.
- Sessions you can see and revoke. Active sessions are listed and can be ended individually — the useful version of "sign out everywhere".
- Password reset that expires. Reset and verification links are single-purpose and time-limited.
And on the platform side
No passwords, except where a network insists
Six of the seven networks connect by OAuth, so postfast never sees a password. Bluesky uses an app password, which you create and can revoke from Bluesky without touching your account.
Disconnect removes the credential
Removing a connected account deletes what postfast held for it. Posts already published stay, because they are yours and they live on the network.
A real deletion endpoint
Meta’s data-deletion callback is implemented, not promised: it erases every connected Meta account belonging to that person across every workspace, and answers with a confirmation code and a status page.
Your own app, if you prefer
Attach your own X credentials to a workspace and publish through them. They are sealed at rest exactly as everything else is.
Common questions
- Can postfast staff read my social tokens?
- The tokens are encrypted at rest under the application secret and no endpoint returns them. They are decrypted in memory only to sign a call to the network they belong to.
- What happens to my posts if I disconnect an account?
- The credential is deleted. Posts already published stay on the network — they are your content. The delivery records that referenced that account go with it.
- Do I have to verify my email?
- Yes. An unverified address cannot use the product. The 14-day trial starts once you are in.
Built, running, and not yet open
postfast is pre-launch. Join the waitlist and you will hear from us when early access opens.