Trust & Security

How We Handle Your Credentials

RSSFlux stores credentials only when necessary to provide a feature. Here is what we store, why, and how it is protected.

What: Access tokens that allow RSSFlux to post on your behalf (e.g., send a message to your Slack channel).
Where: Stored in an encrypted PostgreSQL database in the user_tokens table.
Scope: We request the minimum permissions needed. For Slack, we only ask for chat:write and channels:read — never admin scopes.
Revocation: You can revoke access at any time by deleting the bot in RSSFlux, or by revoking the app from the provider's settings page.

What: A URL that tells RSSFlux where to send notifications.
Where: Stored in the database in the webhooks table.
Note: A webhook URL alone cannot be used to access your account — it can only receive messages.

What: Keys that enable paid or external services.
Where: Stored in the settings database table or in server environment variables.
For Stripe and OpenAI: Keys are set in environment variables (.env file) and never stored in the database.

Clerk session tokens — Authentication is handled entirely by Clerk (a dedicated auth SaaS). We never see or store your session token.
Make / Zapier / n8n credentials — These are managed by those services directly. You authorize them through their own OAuth flows, and they handle token storage.
Your social media passwords — We never ask for or store passwords. All access is through OAuth (e.g., "Sign in with Facebook").

| Layer | Protection |

|---|---|

| Database | PostgreSQL at rest. Connection is local (not exposed to the internet) when running in Docker. |

| API | All API endpoints require authentication via Clerk. Admin endpoints require explicit admin privileges. |

| Network | OAuth callbacks and webhook deliveries use HTTPS when available. |

| Logging | Delivery logs are automatically pruned after 30 days. |

1. Use strong, unique passwords for your Clerk account

2. Review connected apps periodically in your Slack / Facebook / etc. settings and revoke any you no longer use

3. Delete unused bots in RSSFlux to remove their webhook URLs from our database

4. For self-hosted setups (signal-cli, n8n), keep those services firewalled and accessible only from the RSSFlux server

If you have questions about security or data handling, use the Support form in the dashboard or ask the Help Bot.