Security, privacy and AI, in plain words
What SemPost does to protect your data and your brand, summarised from our published policies. Each section links to the full text, which is the one that applies.
At a glance
Encrypted on the way and at rest
Connections use TLS 1.2 or 1.3. Secrets and tokens are encrypted, passwords and new two-step recovery codes are stored as Argon2id hashes, and backups are encrypted before they leave our server.
Each workspace kept apart
Row-level security in the database lets a request reach only its own workspace's rows.
Two-step verification
Turn it on for yourself, or require it for everyone in your workspace.
Your data isn't for sale
We don't sell personal data, use it for advertising or train AI models on it.
AI content is labelled
Files made with AI carry Content Credentials (C2PA), and posts get the network's AI label where SemPost can set one.
Take your data with you
Download your workspace's data or your own, and delete your account or workspace, in the app.
Security
- The app, the websites, the database and the cache run on Contabo servers in the USA, behind Cloudflare's network. Media files and encrypted backups are stored in Cloudflare R2.
- Signing in needs a verified email address. A new password can't be a common one and is checked against known data breaches; after 3 failed sign-ins a bot check is added, and after 10 the account locks for 15 minutes, doubling each time.
- Sessions end after 7 days without use and after 30 days at most. You can see yours and end the others.
- AI assistants connect only to a workspace where an owner has turned on Allow assistant connections, and only an owner can connect one, on SemPost's own page with OAuth. Each connection works in one workspace and is checked again on every call; turning the setting off ends every connection at once.
- Our staff work in a separate admin console behind Cloudflare Access, with two-step verification on every sign-in. Their actions are written to the audit log, sensitive ones with a reason.
- Uploaded files are scanned for malware before anything opens them, and pictures lose their metadata, such as the location, when they are re-encoded.
- The database is backed up every day, encrypted. We can restore it to any point in about the last four weeks, and a restore is tested automatically every month.
- Every 15 minutes, a copy of every backup also goes to a separate, locked storage area, where it can't be deleted or changed for 20 days and is kept about four weeks. The monthly restore test runs from that copy too.
- SemPost holds no security certification, such as ISO/IEC 27001 or a SOC 2 report, and hasn't yet had an external penetration test.
Read the full text
- Security and Responsible DisclosureHow SemPost protects your data, how we handle incidents, and how to report a security vulnerability to us.
- Data Processing AgreementThe terms under which SemPost processes personal data on behalf of customers who use it as controllers.
- Connect an AI assistantAllow assistant connections in a workspace, connect an assistant such as Claude as its owner, let it write posts that wait for your approval and automation rules that arrive switched off, let it change your settings and work with your media and videos, confirm on SemPost's page what it asks to approve, delete, start or remove, and see or end the connections.
Privacy and your data
- For your account, sign-in, billing records and our emails, we decide how data is used: we are the controller. For the content in a workspace we act on your instructions, as your processor under our Data Processing Agreement.
- The access tokens of your social networks are held by our publishing partner Zernio, not by SemPost. When you disconnect an account, it's removed there too.
- Shopify access is read-only: products, inventory, discounts, markets, publications and languages. SemPost asks for no access to your customers or orders.
- On the web you pay on Link's pages (by Stripe): card numbers, billing addresses and tax IDs never reach SemPost.
- How long we keep things, for example: ended sessions 30 days, sign-in attempts 90 days, the audit log 2 years with IP addresses cleared after 1 year, backups about 4 weeks.
- A deleted workspace waits 7 days, so you can change your mind, then goes for good. Deleted data can stay in the backups until they expire.
- This website sets no cookies of its own and has no forms that ask for personal data. Visits are counted with Cloudflare Web Analytics, which uses no cookies. Our blog counts on our own server how its articles are read, as daily totals kept for 400 days, without cookies and without keeping IP addresses or browser details.
- If you sign up after following a link that carries campaign tags, like the links in our social media posts, we keep those tags with your account to see which of our posts bring sign-ups.
Read the full text
- Privacy PolicyHow SemPost collects, uses, shares, stores and protects personal data, and how you can use your rights.
- Data Deletion InstructionsHow to delete your SemPost account, a workspace, a connected social account or single items, how to ask us by email, and what we keep and why.
- Cookie PolicyWhich cookies and browser storage SemPost uses in its app, its Shopify app and its websites, why, for how long, and how you can control them.
- KVKK Information NoticeInformation under Article 10 of Turkey's Personal Data Protection Law No. 6698 on the purposes, legal grounds and methods of SemPost's processing of personal data and on its recipients.
- Export or delete your dataDownload your workspace's data or your own as a ZIP file, delete a workspace with 7 days to change your mind, or delete your account.
AI transparency
- SemPost uses AI only for the work you ask for, or that an automation rule you switched on prepares: post texts, scenes, motion clips, voiceovers and ambient sound.
- Files made with AI carry Content Credentials (C2PA), a signed record saying that SemPost made them with AI. Anyone can look at one with contentcredentials.org/verify.
- Posts with AI pictures or videos get the network's AI label on Instagram, YouTube and Pinterest, and on TikTok videos published directly. Facebook, Threads, LinkedIn, Bluesky and Google Business Profile have no label field: add a note yourself where needed. The label can't be switched off in SemPost.
- Text the AI writes is not labelled: add a disclosure yourself where a law or a network asks for one.
- Scenes have no people unless you choose them, and the people in AI scenes are made up. SemPost offers no avatars and no voice cloning.
- By default, what the AI and automation write waits for a person's approval.
- Every post an AI assistant you connect writes or changes waits for a person's approval, whatever the workspace's approval rule, and we check that approval again before the post goes out.
- Your content doesn't train AI models: SemPost doesn't use it for that, and under their terms neither may Anthropic nor Google's paid Gemini API.
Read the full text
- AI Content PolicyHow SemPost makes content with AI, how it marks that content, and what you must do before you publish it.
- AI labels on your pictures and videosWhich files SemPost marks as made with AI, the Content Credentials it adds, the Made with AI box for uploads, marking files later, and the label each network gets.
Who processes data for SemPost
The companies that process personal data for SemPost, and what each one does.
- Contabo runs our servers. Cloudflare is the network in front of them, and stores media files and backups.
- Zernio is our social media gateway: it connects your accounts and publishes your posts.
- Anthropic writes texts; Google edits images and reads voiceovers aloud; fal.ai runs the models for video clips and ambient sound.
- Resend sends our emails, with open and click tracking switched off.
- Have I Been Pwned and Stability AI receive no personal data. Link (Stripe) and Shopify decide for themselves how they handle payment and install data.
- We announce a new sub-processor at least 14 days before it starts, by email to the owners and admins of every workspace.
Service status and incidents
- SemPost's status page is at status.sempost.ai.
- When an incident affects the service, we tell the affected workspaces by email.
- If a personal data breach affects your content, we tell the workspace's owners by email within 48 hours of becoming aware of it.
Report a security problem
We welcome reports from security researchers, and from anyone who finds a weakness in SemPost.
- Email [email protected], in English or Turkish: what's affected, the steps to reproduce the problem, what an attacker could do with it, and how to reach you.
- We confirm your report within 3 business days and send our first assessment within 10 business days.
- Research in good faith that follows our rules is treated as authorised, and we won't take legal action over it.
- Please give us time to fix the problem before you tell anyone else: until it's fixed, or 90 days after your report, whichever comes first.
- We don't run a paid bug bounty programme.
The contact for security reports is also published, machine-readable, in our security.txt file.
Write to us
- Security problems
- [email protected]
- Privacy questions and requests
- [email protected]
- Legal notices
- [email protected]
- Help with your account
- [email protected]