SocialScalr security and trust

Outbound LinkedIn activity is sensitive. The wrong tool can leak your LinkedIn cookie, your lead list, or your customer pipeline. Here is how SocialScalr is built so it doesn't.

By Mark Gabrielli · Last reviewed May 24, 2026 · Contact: [email protected]

Architecture in one paragraph

The dashboard is static HTML/JS served from Cloudflare Pages. API requests hit Cloudflare Pages Functions, which authenticate the Supabase JWT and call Postgres directly. Postgres enforces row-level-security policies that scope every row to its owning user or team. The Chrome extension runs inside the user's own LinkedIn browser session: it requests jobs from our API (authenticated with a user-specific API token), then performs the LinkedIn click/scroll/type inside the user's tab using DOM events. Your LinkedIn session cookie is never transmitted to SocialScalr.

What we store, what we don't

Row-level security (the most important table in this doc)

Every table holding customer data has a Postgres RLS policy. The shape is:

CREATE POLICY "owner_only_select" ON leads
  FOR SELECT
  USING (owner_id = auth.uid());

CREATE POLICY "owner_only_modify" ON leads
  FOR ALL
  USING  (owner_id = auth.uid())
  WITH CHECK (owner_id = auth.uid());

This means a SQL injection or a bug in our API code cannot leak data across customer accounts. Postgres itself refuses to return rows that don't match the requesting JWT's sub claim. Team-shared tables use a parallel team_member() security definer function.

Backups and disaster recovery

• Daily logical backups of the entire Postgres database to an encrypted S3 bucket in a different AWS region (US-West).
• Point-in-time recovery (PITR) up to 7 days for paid plans, via Supabase's continuous WAL streaming.
• Restore time objective (RTO): under 60 minutes for full database restore.
• Recovery point objective (RPO): under 5 minutes for paid plans, under 24 hours for free.
• Soft-delete: rows you "delete" in the UI are flagged deleted_at and recoverable for 30 days, then permanently purged.

The Chrome extension - what it can and can't do

The extension manifest requests only the permissions it needs:

• activeTab + scripting on linkedin.com and salesnavigator.com. Required to read the DOM and dispatch clicks.
• storage. Used to cache the API token locally so we don't re-fetch it every page navigation.
• cookies. NOT requested. We never read your LinkedIn cookie.
• history / tabs / downloads. NOT requested.

Source code of the extension is reviewed by the Chrome Web Store team on every submission and the manifest is public at chrome://extensions for any user to audit.

Account security features

• TOTP 2FA available on all plans. Use any standard authenticator (Google Authenticator, Authy, 1Password, Bitwarden).
• Audit log: every privileged action (login, password change, API token rotation, payment update, team-member add/remove) is logged for the account owner to review under Settings → Audit log.
• API token rotation: self-serve in the dashboard. Old tokens revoke immediately.
• Session timeout: dashboard sessions expire after 30 days of inactivity. Hard logout endpoint available.
• Team roles: Owner, Admin, Member. Members cannot see billing or remove other users.

GDPR and data rights

SocialScalr is operated by WETYR Corp, a US-registered entity. We are the data controller for account data and the data processor for outreach contact data you upload.

• Access: request a full JSON export of your data at any time via Settings → Export, or email [email protected]. Delivered within 30 days; usually within 24 hours.
• Rectification: edit any field in the dashboard yourself, or email us.
• Erasure (right to be forgotten): cancel + delete your account from Settings → Danger zone, or email [email protected]. We hard-delete within 30 days (the 30-day soft-delete window is a safety net; you can also request immediate purge).
• Portability: data export is JSON + CSV, importable into HubSpot, Salesforce, Notion, Airtable, etc.
• Restriction / objection: pause processing or restrict specific data types by email.
• DPA (Data Processing Agreement): available on request to [email protected]. Pre-signed PDF based on the EU SCCs.

Sub-processors

SocialScalr uses these sub-processors to run the service. Full list, kept current:

Each is bound by a Data Processing Agreement. We notify customers at least 30 days before adding a new sub-processor.

Bug bounty

Responsible disclosure to [email protected]. Encrypt sensitive details with the PGP key at /security/pgp.asc if you prefer.

Scope: socialscalr.com, *.socialscalr.com, the Chrome extension (any version on the Web Store), and the public REST API. Out of scope: third-party services (LinkedIn, Square, Supabase - report those upstream), self-XSS, DoS via volumetric attack, social engineering of staff.

Rules: first reporter for each unique issue wins. Don't access, modify, or exfiltrate data you don't own. Don't run scanners that generate >100 req/sec. Don't publicly disclose before we've fixed and you've gotten an OK.

Incident response

If we detect or are notified of a security incident affecting customer data:

1. Containment within 1 hour (revoke tokens, rotate keys, isolate the affected component).
2. Initial impact assessment within 24 hours.
3. Affected customers notified by email within 72 hours, with what we know and the steps we're taking.
4. Public post-mortem within 14 days, posted to status page + this page.

To date, we have had zero known security incidents affecting customer data.

Compliance roadmap

Honest about where we are. SOC 2 Type II is on the roadmap for Q4 2026 once the team is large enough to support the audit cadence. We're not pursuing ISO 27001 or HIPAA - LinkedIn outreach data is not PHI and our customers are not regulated entities for this workflow. If you're an enterprise buyer with specific certification requirements, talk to us early: [email protected].