Legal
Security
Lemmek holds access to other people's social accounts. We treat that access as the most sensitive thing we store.
Contents
1. Token encryption
OAuth access and refresh tokens are encrypted at rest with AES-256-GCM using envelope encryption. Data keys are protected by master keys held in AWS Key Management Service (KMS) and never stored alongside the data. Tokens are decrypted only in memory, at the moment they are needed to call a platform, and are never written to logs or returned by our API.
2. EU hosting
Our application servers and databases run in the European Union. All traffic is encrypted in transit with TLS 1.2 or higher. Media files are stored in object storage with time-limited access links and deleted on a fixed schedule (see the Privacy Policy).
3. Minimum permissions
For every platform we request only the permissions needed to publish content and confirm the result. We do not request access to messages, followers or analytics about other people. The permissions for each platform are listed on the Platforms page.
4. Tenant isolation
Every record belongs to one customer organisation and project, and every query is scoped to it. Test and live environments are separated, and test keys cannot publish to real accounts. API keys are stored only as hashes.
5. Access and logging
Production access is limited to a small number of staff, requires multi-factor authentication, and is logged. Security-relevant actions, such as connecting and disconnecting accounts, key creation and data deletion, are recorded in an audit log kept for one year.
6. API security
- Webhooks are signed with HMAC-SHA256 following the Standard Webhooks specification, with timestamp checks against replay.
- Idempotency keys prevent duplicate requests from creating duplicate posts.
- Rate limits protect both the service and connected accounts.
- AI agents using our MCP server get dry runs by default and must explicitly confirm real publishing.
7. Responsible disclosure
If you believe you have found a security vulnerability, please email security@lemmek.com with a description and steps to reproduce. We will acknowledge your report within 3 business days and keep you informed as we fix it.
Please do not access or modify other people's data, degrade the service, or disclose the issue publicly before it is fixed. We will not take legal action against research carried out in good faith under these rules.