No passwords
You sign in on each network's own page. Networks give us access tokens you can revoke at any time. Bluesky, Telegram and Discord use app passwords, bot tokens and webhooks you can delete.
Encrypted tokens
Access tokens are encrypted at rest with AES-256-GCM and are never shown to anyone, including your AI app, our support team or the API.
Least permissions
We ask each network only for what publishing needs. Every permission and why we need it is listed on each platform page.
You confirm every post
Saymany shows a preview for each network and publishes only after you confirm. Contributors cannot publish at all.
Workspace isolation
Every request is scoped to one workspace and checked against your role and brands.
Sign-in
Email codes or Google sign-in; OAuth 2.1 with PKCE for AI apps; API keys stored as hashes and shown once.
Audit log
Every action is recorded with who did it, when, and from which app. Kept 12 months.
Hosting
Servers in the EU (Hetzner, Germany), TLS everywhere, payments handled by Stripe (we never see card numbers).
Deletion
Disconnecting deletes tokens immediately. Ask your AI to delete your workspace or account at any time. More
Report a vulnerability
Email hello@saymany.com with details. We reply within 2 working days and do not take action against good-faith research.