Security

Your accounts are safe with us.

Letting an AI post for you only works if you can trust it with your main account. Here is exactly how Ghostedit keeps that account safe.

Instagram Graph APIOfficial API
TikTok Content Posting APIOfficial API
YouTube Data API v3Official API
MCP with OAuth 2.1The standard Claude uses
Sign in with the platformWe never see your password
TLS 1.3 + AES-256Encrypted in transit and at rest
Person-only approvalsAI never approves its own post
Delete any timeOne click removes everything

Logos belong to their owners. Ghostedit uses their public APIs and is not affiliated with Meta, TikTok, Google or Anthropic.

Six ways we protect your account.

Official APIs only

Instagram's Graph API, TikTok's Content Posting API and the YouTube Data API. The same doors the platforms' own partners use.

No passwords, ever

You sign in on Instagram, TikTok or Google's own page. We receive a key, never your password.

Keys locked away

Access keys are encrypted at rest and only used by the server that publishes your posts.

Only what posting needs

We ask for publishing and stats access. Not your DMs, not your followers' data, not your password.

You see everything

Every post an agent schedules lands in your calendar first, with who scheduled it and when it goes out.

Leave in one click

Disconnect an account and its key is deleted. Delete your Ghostedit account and your data goes with it.

What an AI agent can and can't do

Agents talk to Ghostedit through seven tools. That's the whole list.

  • Can: list your connected accounts, schedule a post, list posts, look up one post, check a post, move a post, cancel a post.
  • Can't: change your profile or password, delete your old posts, follow or unfollow, read or send DMs, or touch an account you didn't connect.
  • Approvals: mark any account "needs approval" and every post waits for you to press Approve, no matter who scheduled it.

Built so posts can't go wrong

  • Checked before it's queued. Length, size and format are checked when a post is scheduled, so it can't fail at post time.
  • Never posts twice. Each post is locked while it publishes, so a retry can't post it a second time.
  • AI labels on TikTok. Videos made with AI get TikTok's AI-generated label, the way TikTok asks.

Where your data lives

  • Hosting: Vercel (app and servers) and Neon (database), in the United States. All traffic uses HTTPS.
  • Payments: handled by Stripe. Your card number never touches our servers.
  • Never sold, never used to train AI. We keep only what's needed to post and report. See the privacy policy.
  • Delete it: follow the steps on Delete my data and we erase it within 30 days.

Found a security problem?

Email alex@chen.media with "security" in the subject. We reply within 2 business days and fix real issues first.

Let the ghost do the posting.

Start free