How we look after your accounts.
Pozy holds access to the accounts your business depends on. Here is what we do to keep that access safe, in plain terms.
Credentials encrypted at rest
Platform access tokens are stored encrypted by our connectivity subprocessor and are never shown to your users. The keys Pozy uses to reach them, and your webhook signing secrets, are encrypted at rest and decrypted only on our servers when a request needs them.
API keys are hashed
We store a hash of each API key, never the key itself. You see the full key once, when you create it.
Scoped keys
Limit a key to specific profiles, make it read-only, block resource groups, and set an expiry date.
Two-factor authentication
Protect every member's sign-in with an authenticator app.
Single sign-on
The workspace owner can connect a SAML or OIDC identity provider for their own email domain, verified over DNS before any sign-in is routed.
Signed webhooks
Every webhook carries X-Pozy-Signature, an HMAC-SHA256 of the body with your endpoint's secret.
OAuth for agents
AI assistants sign in through OAuth with scopes you approve. You can revoke their access at any time.
Roles and logs
Owner, admin, member, viewer and billing roles, request logs for every API call, and an activity log of changes to keys, members and settings.
Platform access
We never ask for platform passwords.
Accounts connect through each platform's own sign-in and consent screen. Where a platform uses an app password instead, such as Bluesky, you create one just for Pozy and can revoke it on the platform at any time.
If an account is disconnected or its access expires, publishing to it stops and the dashboard asks you to reconnect.
Certifications
What we do not claim yet.
Pozy does not hold SOC 2 or ISO 27001 certification today. When that changes, the report will be available here on request. Until then we are happy to answer security questionnaires.
Found a vulnerability? Email support@pozy.ai with the subject “Security”. Please give us a reasonable time to fix it before you share it. The same contact is in our security.txt.
See also our subprocessors and data processing terms.