1. Security Philosophy & Architecture

FlockPush, operated by BattaTech, provides an enterprise-grade multi-network social broadcasting engine. We treat the confidentiality, integrity, and availability of our users' accounts, social credentials, and publishing queues as our highest priority.

Our architecture implements defense-in-depth across our cloud runtime, edge reverse proxies, relational database layer, and third-party API connector integrations.

2. Cryptographic Token Protection & Key Management

Third-party network credentials (OAuth 2.0 access tokens, refresh tokens, and API secrets) are protected using envelope encryption:

AES-256-GCM Envelope Encryption: Every social channel secret is encrypted using a unique data encryption key (DEK) wrapped by a dedicated Key Encryption Key (KEK) managed in Google Cloud KMS (Cloud Key Management Service).
Zero Plaintext Storage: Plaintext tokens and client secrets are never persisted to disk, recorded in structured logs, or leaked across error traces.
Ephemeral Decryption: Worker runtimes decrypt credentials strictly in-memory during dispatch and immediately discard them following HTTP transmission to destination social networks.

3. Multi-Tenant Data Isolation

FlockPush enforces strict multi-tenancy at the data access layer:

Repository Scoping: All database queries require a cryptographically verified Actor context and explicitly filter by organization_id and authorized workspace_id.
Role-Based Access Control (RBAC): Granular permissions enforce separation of duties across Owner, Admin, Member, and Guest roles.
Two-Factor Authentication (2FA): Time-based one-time password (TOTP) enforcement is available to protect all organization accounts against credential stuffing and account takeover.

4. Network & Infrastructure Security

Data in Transit

TLS 1.3 encryption is strictly enforced across all incoming web requests, API calls, and outbound webhook delivery. HSTS headers prevent downgrade attacks.

DDoS & Rate Limiting

Distributed denial-of-service mitigation and rate limits (120 req/min for standard endpoints, 10 post creations/sec) safeguard platform stability.

Containerized Runtime

Stateless containers deployed on Google Cloud Run with read-only root filesystems and minimal unprivileged execution environments.

Media Isolation

Uploaded assets are stored in isolated Cloudflare R2 object storage buckets with strict signed URL validation and 90-day retention policies.

5. Vulnerability Disclosure Program (RFC 9116)

We welcome responsible security researchers and practitioners to report potential security issues. We adhere to the standard security reporting format at /.well-known/security.txt.

Safe Harbor Guidelines:

Never attempt to access or modify data belonging to other organizations or tenants.
Do not execute denial of service attacks, spam campaigns, or automated volumetric testing against production systems.
Give our security team a reasonable period of time (minimum 90 days) to address reported vulnerabilities prior to public disclosure.

To submit a vulnerability report, email our security engineering team directly at security@flockpush.com. We acknowledge receipt within 24 business hours and provide status updates every 72 hours until resolution.

6. Subprocessors & Compliance Audits

All third-party infrastructure vendors and subprocessors are vetted for SOC 2 Type II, ISO 27001, and GDPR compliance. Review our verified subprocessor inventory on our dedicated Subprocessors Directory.

Security & Vulnerability Disclosure