How we do it

Six pillars of responsible platform design.

Encryption at rest & in transit

All data is stored encrypted (AES-256-GCM) and transmitted over TLS 1.3. Social-media cookies get per-tenant scoped keys.

Multi-tenant isolation

Every agency has its own tenant scope at the database level. Cross-tenant reads are architecturally impossible, not just by access rules.

GDPR-compliant

Fully GDPR-compliant: a data processing agreement per agency, sub-processors within the EU, data-rights workflows in-product (export, delete, access).

Role-based access & audit logs

Granular roles per team member, an audit log of every critical action (SyncLog), JWT sessions with a 30-day lifetime and automatic rotation.

Rate limiting & abuse prevention

Login attempts, API routes and public endpoints are rate-limited. Brute-force, scraping and DoS attempts are stopped automatically.

Responsible disclosure

Security researchers can report vulnerabilities directly via security@senly.io. We confirm within 24 hours and patch critical issues within 72 hours.

Standards

Standards we adhere to.

AVG / GDPR

EU regulation 2016/679

TLS 1.3

Modern transport security

AES-256-GCM

At-rest encryption

bcrypt

Password hashing

HSTS

2-year HTTP Strict Transport

CSP

Content Security Policy headers

Senly Connector — security in detail

The optional Chrome extension has access to social-media session cookies. That is sensitive stuff. How we keep it watertight:

Opt-in per client: the extension only reads cookies after you explicitly click "Connect" in a client profile. No background collection.
Per-tenant encryption: each tenant has its own AES-256-GCM key. Agency A's cookies are physically undecryptable by agency B — not even by our engineering team.
No passwords: we only read session tokens from already-active sessions. Client passwords never touch our system.
Instantly revocable: "Disconnect" removes the encrypted cookies from the database immediately. No residual data.
Open source extension: the Connector code is publicly inspectable, so researchers can verify that the extension does what we claim.

Incident response

In the event of a data breach that poses a risk to the individuals involved, we notify the agency in question within 24 hours of discovery. The agency is responsible for reporting to the Dutch Data Protection Authority within 72 hours, and we support with technical forensics and logs.

Reporting a vulnerability

Found something? We appreciate responsible disclosure. Send details to security@senly.io — preferably PGP-encrypted with our key (available on request). We confirm within 24 hours and keep you posted on the fix.

Your client data, our highest priority.