Security

Signing in

• Passwords. Sheevook keeps only a scrypt hash of each password, never text anyone could read back.
• Sessions use a signed cookie that scripts on the page cannot read. A session lasts 30 days, or 12 hours for Computing America staff.
• Passkeys and two-step sign-in. An account with a password can sign in with a passkey. It can also turn on two-step sign-in with Computing America ID, backed by single-use recovery codes. A workspace owner or admin can make two-step sign-in mandatory for the workspace's password members.
• Abuse limits. Sheevook limits how often anyone can try to sign in, sign up, accept an invitation or call a public endpoint.
• In transit. Sheevook encrypts all traffic and tells browsers to use only HTTPS for this site.

Roles and access

Each person in a workspace is an owner, an admin, a member, or a person who needs approval. A person who needs approval can write and submit content, and nothing else. Teammates join a workspace only by accepting an invitation, or through the workspace's single sign-on. An invitation link expires after 7 days. A removed member loses access at once.

Sheevook keeps every workspace and project apart from the others. It answers a request for something in another workspace as if that thing did not exist.

Single sign-on

Workspaces on the Scale and Enterprise plans can connect their own identity provider over OIDC, such as Okta, Microsoft Entra ID or Google Workspace. A workspace proves the email domain it signs in from with a DNS record, and its owner can require single sign-on of everyone else. SAML is not available.

Audit log

Sheevook records who did what in a workspace. Each entry carries a link to the one before it, so anyone checking the log can spot an edited or removed entry. Entries never contain passwords or tokens. Workspaces on the Scale and Enterprise plans can read and export the log. Sheevook keeps it for a year on Scale and two years on Enterprise.

Platform connections

When you connect a social, ad or analytics platform, it issues an access token.Sheevook encrypts each token with AES-256-GCM before storing it, never sends it to your browser, and keeps the decryption key apart from the database. Disconnecting a platform deletes its tokens at once.

AI providers and your content

• Anthropic receives the brand profile and the text you ask it to write or rewrite.
• OpenAI, Google, fal.ai and ElevenLabs receive image, video and voice prompts. When you ask for a picture of your own product, they also receive the product images and logo from your library.
• Photos of people in your library are never sent to an AI provider.

Sheevook sends nothing until a generation needs it, and much of it works without any AI provider. It flags media made with AI as AI-generated, and the flag goes with the post to each platform that has a way to disclose it.

A person approves before anything publishes

Sheevook publishes no post until a person has approved it. Claude and other AI assistants connected to a workspace, and API keys, can write drafts and send them for review. They cannot approve anything. An assistant can schedule or retry only content that a person has already approved.

Computing America staff access

A small number of staff can open a workspace to give support. Sheevook records every open, with who opened it and when. A workspace with a connected Google account opens only with its owner's permission in Settings. The one exception is a security or legal reason, which the staff member states and Sheevook records. Owners see each of those opens, with its reason, in Settings.

Hosting and backups

Sheevook runs on Vercel in the United States. It stores workspace data, including uploaded and generated media, in a managed Neon Postgres database. The database keeps a continuous history, so Computing America can restore it to an earlier moment after a bad change or a deleted record.

Exporting and deleting your data

• Export. You can export a project's data as a JSON file at any time. The audit log records each export.
• Deletion. You can delete content, a whole project, or your account. Deleting a project deletes everything in it, and deleting your account takes effect at once. See what an account deletion removes and keeps.
• Google data. Seven days after you disconnect a YouTube channel or a Google Business Profile, Sheevook deletes the numbers, comments and reviews it stored from it.

Not yet in place

Sheevook has no SOC 2 report and no ISO 27001 certificate today. This page describes what the product does, and you can ask us about any line of it.

Report a vulnerability

If you think you have found a security problem in Sheevook, write to privacy@sheevook.com and describe what you found and how to reproduce it. You can also find this contact in security.txt.