Social Anchor takes the security of client and visitor data seriously. This page describes the technical, organizational, and operational measures we use to protect payment information, account credentials, brand assets, and other sensitive data we handle on behalf of our clients.
All data transmitted between your browser, our systems, and the third-party services we use is encrypted in transit using Transport Layer Security (TLS 1.2 or higher).
Sensitive data at rest is encrypted using industry-standard encryption protocols, including AES-256 where applicable. Credentials, API keys, and other sensitive secrets are stored in encrypted password management systems with strict access controls.
Social Anchor uses Stripe as our payment processor for all USD transactions. Stripe is certified to PCI Service Provider Level 1, the highest level of certification available in the payments industry.
Card information is collected by Stripe directly through their secure infrastructure and never touches Social Anchor's systems. We do not store, process, or transmit full credit card numbers, full bank account numbers, or full Social Security numbers.
We retain only the minimum payment metadata needed for accounting and reconciliation (date, amount, last four digits of card, invoice number, Stripe transaction ID).
Stripe's security overview is available at stripe.com/security.
Client data, including brand assets and project files, is stored on enterprise-grade cloud infrastructure with the following protections:
We use vetted cloud storage providers, including Google Workspace and pCloud, each of which maintains its own SOC 2 and ISO 27001 certifications.
Access to client data is granted on a need-to-know basis to authorized team members only:
When clients grant us access to their social media accounts or other systems, we manage those credentials with the following safeguards:
We work with third-party service providers that may handle data on our behalf. Each is vetted for security posture, contractually obligated to maintain appropriate safeguards, and required to comply with applicable law. Our major providers include:
A full list of our service providers and their security certifications is available on request.
Social Anchor maintains compliance with applicable laws and industry standards relevant to our services, including:
We review our practices regularly and update them as standards, regulations, and threats evolve.
We maintain a documented incident response plan covering:
In the event of a security incident that affects your data, we will notify you without undue delay and provide the information needed to assess the impact, as required by applicable law.
If you discover a vulnerability, suspect a security issue with our systems, or want to report a concern, please contact us directly. We take every report seriously.
We aim to acknowledge security reports within two business days and provide an initial assessment within five business days.
