Authorization instead of passwords
BrandMilo does not collect Etsy, Pinterest, Facebook, Instagram, or TikTok passwords. Users authorize access on the provider’s website.
Security
Current security posture
Implemented controls, provider-dependent work, and future items are listed separately. BrandMilo does not claim monitoring, MFA, or audits that are not in place.
Implemented
Controls present in the BrandMilo application and production hosts.
Token protection
OAuth access and refresh tokens are encrypted at rest. API responses do not return raw tokens. Encryption keys are stored outside the application database.
Least privilege
Phase 1 Etsy requests listings_r and shops_r only. Phase 1 Pinterest requests user_accounts:read, boards:read, boards:write, pins:read, and pins:write so Create Pin can publish to a selected existing board. BrandMilo does not create or edit Pinterest boards.
Secure transport
Production BrandMilo hosts use HTTPS. OAuth callbacks are exact HTTPS URIs on api.brandmilo.com.
Tenant isolation
API requests and background jobs authorize workspace membership. Resources from another organization are rejected.
Log redaction
Authorization headers, cookies, tokens, codes, and verifiers are stripped from application logs and error payloads.
Media fetch controls
Remote image URLs used for Create Pin are checked before fetch (HTTPS, SSRF, size, and type controls).
Data control
Disconnect enabled integrations such as Etsy from Integrations. Pinterest disconnect becomes available when Pinterest Connect is enabled. For account deletion, email privacy@brandmilo.com using the public Data Deletion instructions.
Integration-dependent
Implemented in software; live proof requires provider access.
Live provider OAuth
Pinterest Trial Access is approved. Production OAuth remains restricted to controlled private-beta validation until credentials and owner/test rollout are enabled. Etsy Personal Access is approved for Private beta. Credentials are not invented here.
Provider rate limits and outages
Retries, 429 handling, and token expiry follow each official API. Behavior after approval is observed against live traffic, not assumed.
Future
Not claimed as current product capability.
Multi-factor authentication
Workspace MFA is not offered in Phase 1. Do not treat this page as an MFA claim.
Public status and SOC reports
A public incident board and third-party audit reports are not published. This page does not claim them.
Responsible disclosure
Security researchers may report vulnerabilities to security@brandmilo.com. Include a clear description, reproduction steps, impact, and any supporting evidence. Do not access data that does not belong to you, disrupt the service, or publicly disclose an issue before a reasonable remediation period.