Security
Your account, kept safe
You're trusting us with your X account and your brand. Here's how we protect both.
Official X sign-in
We connect to X through its official OAuth flow. We never see your X password, and you can disconnect from settings at any time; the tokens are deleted when you do.
Encrypted X tokens
X access tokens are encrypted at the application level with AES-256-GCM before they're stored.
No passwords to leak
Sign-in is passwordless: Google, X, or a one-time code sent to your email, handled by our authentication provider.
Secrets stay on the server
AI keys, X credentials and payment keys live only on our servers, never in your browser. Prompts are built on the server from structured requests.
Payments by Stripe
Card details go straight to Stripe. We never see or store your card number.
Your data, exportable
Download everything in your studio as one JSON file from settings. Deleting your account deletes your studio, media and X connections.
Practices
- HTTPS everywhere, with HSTS so browsers never fall back to plain HTTP.
- Rate limiting on the API to blunt abuse and brute force.
- Security headers on every page of the site.
- Scheduled posts publish from our servers, so no session needs to stay open in your browser.
Responsible disclosure
Found a vulnerability? Email support@extudio.dev with the details and how to reproduce it. We’ll confirm we got it, keep you posted, and won’t take action against good-faith research. For how we handle personal data, see the privacy policy.
Your next week of posts,
done this afternoon.
Sign up with your email, set your brand, and start writing. Upgrade when you want AI and auto-posting.