🔒 Data stored in India · Google Cloud, Mumbai
How we protect your account and your data
ViralDM connects to Instagram through the official API and never asks for your Instagram password. This page lists what we protect, how we do it and where your data is kept.
Google Cloud's infrastructure is SOC 2 / ISO 27001 certified. ViralDM itself has not completed a SOC 2 or ISO 27001 audit.
- Instagram and other social tokens
AES-256-GCM - Your password
bcrypt · cost 12 - API keys
SHA-256 hash · shown once - Integration keys and webhook secrets
AES-256-GCM · shown once - Card details
never stored · Razorpay
Database in Mumbai, India · daily off-site backups
Security practices
Built in from the first line, not added later
What is in place today, area by area. If something here stops being true, this page changes with it.
Encryption
- HTTPS only. HSTS tells browsers never to fall back to plain HTTP.
- Instagram, Facebook, YouTube, LinkedIn and WhatsApp tokens are encrypted with AES-256-GCM before they are written to the database.
- Passwords are hashed with bcrypt at cost 12, never stored in plain text.
- The database disks are encrypted at rest.
Infrastructure
- Hosted on Google Cloud Platform, Mumbai (India).
- Self-managed PostgreSQL, encrypted at rest, with automated daily backups.
- Automated off-site encrypted database backups with a restore procedure.
- Cloudflare DDoS protection and WAF in front of the site.
The underlying cloud infrastructure is SOC 2 / ISO 27001 certified by Google Cloud; ViralDM itself has not completed a SOC 2 or ISO 27001 audit.
Sign-in
- Two-factor login with an authenticator app, an email code or single-use backup codes.
- Rate limits and lockouts on repeated failed logins.
- An email when you sign in from a new device, and a list of your active sessions that you can sign out of.
- Secure, httpOnly session cookies. Sign in with Google or GitHub over OAuth 2.0.
- Instagram tokens are refreshed before they expire.
Monitoring
- 24/7 uptime monitoring from outside our servers, so an outage is reported even when the server itself is down.
- The team is alerted straight away on crashes and bursts of server errors.
- An Instagram account is paused automatically when its sends start failing at a high rate.
- Audit logs for admin actions. Destructive admin actions need a fresh password or 2FA code.
Incident response
- Documented response playbook.
- Breach notification within 72 hours.
- Post-incident reports for transparency, on the status page.
- Continuous improvement after each incident.
Code security
- Input validation and sanitisation on incoming requests.
- SQL injection protection through the Prisma ORM.
- Helmet security headers with a Content Security Policy.
- CSRF tokens on state-changing requests.
- Dependency vulnerability audit and a committed-secret scan in CI; either one fails the build.
API security
- API keys are stored only as a SHA-256 hash. You see a key once, when you create it.
- Rate limiting per key and per IP.
- Webhook signature verification on incoming events from Instagram, Razorpay and YouTube.
- Scope-limited permissions:
mcp:read,mcp:writeandmcp:adminfor connected apps.
Data privacy
- Minimal data collection.
- Data isolation between tenants.
- Right to deletion honoured within 30 days. How to delete
- No selling of user data, ever.
Compliance
- Indian DPDPA 2023 compliant.
- GDPR ready (EU users).
- CCPA compliant (California users).
- Meta Platform Policy compliant.
- YouTube API Terms compliant.
Where your data lives
From a comment to a reply, step by step
What happens to a follower's message when an automation answers it, and where each kind of data is kept afterwards.
A follower writes
They comment or send a DM. Instagram sends the event to ViralDM.
Signature checked
We verify the event's signature before reading it. An event that fails the check is rejected.
Handled in India
Your automation runs on our servers in Mumbai. If AI replies are on, the message text goes to an AI provider to write the answer.
Reply sent
The reply goes back through Instagram's official API, using your token, which is decrypted only in memory for the call.
| What | Where it is kept | How it is protected |
|---|---|---|
| Your account, automations, subscribers and messages | ViralDM's database on Google Cloud, Mumbai (India) | Encrypted disks, restricted access, daily backups |
| Instagram and other social account tokens | The same database | AES-256-GCM encryption before storage |
| Your password | The same database | A bcrypt hash only; the password itself is never stored |
| API keys | The same database | A SHA-256 hash only; the key is shown to you once |
| Images and videos you upload | Cloudinary media CDN | Served over HTTPS |
| Message text for AI replies | The AI providers listed on our sub-processors page | Sent only when AI replies are on |
| Card and payment details | Razorpay (India) | Card details never reach ViralDM's servers |
| Database backups | Off-site | Encrypted, taken daily |
Every provider that handles personal data for us, with its purpose and region, is on the sub-processors page.
Vulnerability disclosure
Found a security issue? Tell us.
Email the security team and include:
- Description of the vulnerability
- Steps to reproduce
- Proof of concept (if safe)
- Your contact info
Security team
[email protected]
We commit to
Do you ever ask for my Instagram password?
No. You connect your account through Instagram's own login screen. ViralDM receives an access token from Instagram, not your password, and stores that token encrypted.
Can I remove ViralDM's access to my Instagram?
Yes, at any time. Disconnect the account in ViralDM, or remove ViralDM from the apps list in your Instagram settings. Either one stops our access.
Is ViralDM SOC 2 or ISO 27001 certified?
No. ViralDM runs on Google Cloud, whose infrastructure is SOC 2 / ISO 27001 certified, but ViralDM itself has not completed a SOC 2 or ISO 27001 audit.
Where is my data stored?
In India, in ViralDM's database on Google Cloud in Mumbai. Uploaded media sits on a CDN, payments are handled by Razorpay, and message text goes to an AI provider only when AI replies are on. The full list is on the sub-processors page.
What happens to my data if I delete my account?
The right to deletion is honoured within 30 days. The steps are on the data deletion page.
Can I turn on two-factor login?
Yes. Use an authenticator app or an email code, and keep the single-use backup codes somewhere safe in case you lose your phone.
Questions about how we handle your data?
Write to [email protected]. We acknowledge every report within 48 hours.