Security

Security is built into the architecture of SocialKit, not bolted on as an afterthought. Our most powerful security feature is architectural: free tools process all data client-side in your browser. This means your data never touches our servers, dramatically reducing the risk of data breaches. For Pro features that do require server-side processing, we use industry-standard encryption and security practices.

All 50+ free tools run entirely in your browser using JavaScript and WebAssembly. When you use the hashtag generator, font generator, character counter, or any other free tool, your inputs are processed locally. No data is transmitted to our servers. This means there is no server-side attack surface for free tools — there is nothing to hack because nothing is sent.

All traffic to and from SocialKit is encrypted using TLS 1.3, the latest and most secure transport encryption standard. Our SSL/TLS certificates are managed by Cloudflare and automatically rotated. For Pro accounts, passwords are hashed using bcrypt with a cost factor of 12. Payment information is handled by Stripe and never touches our servers.

SocialKit is hosted on Cloudflare’s global edge network, which provides:

• DDoS protection: Automatic mitigation of distributed denial-of-service attacks at the network edge.
• Web Application Firewall: Real-time filtering of malicious requests and common attack patterns (SQL injection, XSS, CSRF).
• Bot mitigation: Advanced bot detection to prevent automated abuse and scraping.
• Rate limiting: API endpoints are rate-limited to prevent brute force and abuse.

For free tool users, no personal data is collected or stored. For Pro users, we store only the email address and subscription status. Payment data is processed by Stripe and is never stored on our servers. All Pro data is encrypted at rest using AES-256. Backups are encrypted and stored in geographically separated regions.

We take security vulnerabilities seriously. If you discover a security issue, we ask that you:

• Report privately: Email us at info@toolly.site with details of the vulnerability. Do not post publicly.
• Allow 72 hours: We will acknowledge receipt within 72 hours and provide an initial assessment.
• Allow 90 days: We request a 90-day window to fix the issue before public disclosure.
• No exploitation: Please do not exploit the vulnerability or access data that is not yours.

We believe in recognizing security researchers who help us improve. If you report a valid vulnerability, we will acknowledge your contribution (with your permission) on this page. For significant findings, we may offer a reward or bounty. We are committed to working collaboratively with the security community.

While we do our part to keep SocialKit secure, you can also protect yourself:

• Use HTTPS: Always verify the padlock icon in your browser. Our site forces HTTPS, but stay vigilant.
• Strong passwords: For Pro accounts, use a unique, strong password. Consider a password manager.
• Keep browsers updated: Browser updates include critical security patches. Enable automatic updates.
• Be cautious with downloads: Only download content you have the rights to. Scan files before opening.

For security-related questions or to report a vulnerability, please email us. We respond to security reports within 72 hours.