Trust centre

This page describes the controls as they are today, checked against the code and the live service. It isn't a certification. The privacy notice covers what is collected, why, who else is involved and how long it's kept.

Signing in

• Passwords are stored only as a one-way hash, using the strongest algorithm the server supports. A password must be at least 10 characters.
• Two-step sign-in is available to everyone, with an authenticator app code or a passkey. Admins must use it; for staff it is optional.
• Sign-in attempts are slowed after five a minute. Five wrong passwords, or five wrong codes, lock the account for 30 minutes and email its owner. A password reset unlocks it straight away.
• "Keep me signed in" lasts up to 30 days, is stored so it can be revoked, and skips the second step on that device.

Keeping agencies apart

• Everything belongs to one agency. Listings and other records are looked up only within the signed-in person's agency, and access to a specific listing or scheduled post is checked again against that record.
• Nothing is usable without signing in, apart from the sign-in pages, the read-only demo and these public pages.
• Feed passwords, ElevenLabs keys, and Meta app secrets and access keys (the Page's, and the signing-in admin's, which lapses after about 60 days) are encrypted in the database and are never shown again once saved.

Accountability

• Staff invitations and removals, branding, feed and music settings, account locks, password resets and account deletions are written to an audit log saying who did it, when and what changed, including the old value where a setting changes. Agency administrators can read their own log; nobody can edit or delete it through the service.
• The log doesn't record every sign-in, or the banners and videos people make.

When someone leaves

• Anyone can delete their own account, and can undo it for 30 days by signing back in. After that it is erased automatically.
• When the last person in an agency deletes their account, the agency's listings, photos, videos, logos and settings are erased 30 days later. The audit log is kept, with the agency's name removed.

In the browser

• The service is served over HTTPS only, and browsers are told to insist on it (HSTS).
• Other websites can't show these pages inside a frame, which stops a hidden page being used to trick someone into clicking a button.
• Fonts and scripts come from this service itself, not from other companies' servers. Visits are counted by analytics I host myself, without cookies.

Hosting and backups

Marketool runs on a Vultr server in Manchester, UK, behind Cloudflare. Vultr's Manchester data centre is certified to ISO/IEC 27001 and SOC 2; those are the host's certifications, not this service's own. The server is backed up automatically by Vultr, and a restore was tested on 10 September 2026.

Not in place yet

• Two-step sign-in is optional for staff, and there are no backup codes if you lose your authenticator.
• Authenticator secrets are stored unencrypted in the database.
• Passwords aren't checked against lists of known breached passwords.
• The content security policy blocks any script the app didn't send, but still allows inline styles, which the banner export needs.
• Uploaded files are checked and logos re-encoded, but files aren't scanned for malware.
• Passkeys haven't been tested end to end with a real device.
• All backups are with the same provider; there is no second, independent copy.
• There is no written data processing agreement for agencies yet.

Reporting a security problem

Email hello@mashreeves.com. I aim to reply within five working days, and sooner to anything that puts someone's data at risk. The same address is in security.txt.