Security

Last updated: November 2026

How Postbelt protects your accounts and data.

Location

Postbelt runs on a dedicated server at Hetzner in Germany, used only for Postbelt. Videos are stored on that server at first and later in Hetzner Object Storage, also in Germany. Encrypted backups go to a second Hetzner data centre in Finland every day.

Access to your accounts

• Postbelt never receives your password, only an access token through the platform's official sign-in (OAuth).
• These tokens are stored only in encrypted form (AES-256-GCM, with a separate random value per entry). The key is kept separate from the database.
• Agencies using Postbelt through the API never see a token, only an account ID.
• Postbelt only requests the permissions it needs to post.
• When you disconnect an account, its token is deleted immediately and revoked at the platform.

Sign-in and connections

• All connections are encrypted over HTTPS.
• Sign-in with the platforms is protected against forgery with a one-time state value and PKCE, and only returns to pre-registered addresses.
• API keys for agencies are stored only as hashes and can be revoked at any time.

Server

• Server sign-in by key only, never by password; repeated failed attempts are blocked.
• A firewall only lets web traffic and server sign-in through.
• Security updates are installed automatically.
• Logs contain no access tokens and no post texts, only IDs.

Website

postbelt.eu sets no cookies, uses no analytics or advertising services and loads nothing from third-party servers. Cloudflare only answers DNS queries and does not sit in front of the website, the app or the API.

Found a vulnerability?

Write to gillian@videowien.at. We respond quickly and thank you for reporting it.