Postiz
Postiz allows you to schedule Slack posts.
You can connect your Slack, select a channel, and write a post that will be posted at a specific time.
You can also change the profile picture and the bot's nickname for publishing.
You can connect your Slack, select a channel, and write a post that will be posted at a specific time.
You can also change the profile picture and the bot's nickname for publishing.
Postiz will be able to view:
Postiz will be able to do:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Developer
Gitroom LLC
Company headquarters location
United States
Terms of service
Privacy & data governance
Data retention policy
Postiz retains Customer Data only for as long as the customer maintains an active account and the Slack integration remains connected. For the Slack integration specifically, we store the bot OAuth access token, the workspace (team) ID, the bot's display name and avatar URL, and the channel ID and name the customer selects as the destination for each scheduled post. We do not read or store Slack message history, channel membership, or workspace member data. Scheduled post content is authored by the customer inside Postiz and is retained as part of their content calendar until the customer deletes the post or their account. Published-message identifiers (message timestamp and permalink) are kept so the customer can view and open their published posts from Postiz.
Data archiving and removal policy
Customer Data is removed when the customer disconnects the Slack channel from Postiz, deletes their account, or requests deletion by contacting support. Disconnecting a Slack channel removes the stored access token and all channel-related settings, and Postiz stops making any API calls to that workspace. When a customer deletes their account, the account and all associated organization data (including connected integrations, tokens, scheduled and published posts, and media) are removed from active use immediately, personal identifiers are irreversibly scrubbed, and remaining records are purged from our systems within 30 days. Uninstalling the app from a Slack workspace revokes the token on Slack's side and any subsequent API call from Postiz fails, at which point the integration is marked as disconnected. Customers can also delete individual posts at any time, which removes them from our database.
Data storage policy
Customer Data is stored in a PostgreSQL database hosted on our cloud provider, encrypted at rest and accessible only over TLS. Slack access tokens are stored in the database and are never exposed to the browser or to third parties; they are used exclusively server-side to call the Slack API on the customer's behalf. Media files (images attached to posts and the bot avatar) are stored in Cloudflare R2 object storage. Access to production infrastructure is restricted to authorized Postiz engineers using role-based access controls and audited credentials. All data in transit between Postiz, Slack, and our storage providers is encrypted with TLS 1.2 or higher. We follow the principle of least privilege and request only the Slack scopes required to list channels and publish messages.
Data hosting company
Railway, Cloudflare
App/service has sub-processors
no
App/service uses large language models (LLM)
no
Certifications & compliance
Data deletion request procedure
We delete all data, emails, and subscriptions
HIPAA compliant
no
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Executive summary is available to potential customers upon request
yes
Supports Security Assertion Markup Language (SAML)
no
Has a dedicated security team
no
Contact for security issues
support@postiz.com
Has a vulnerability disclosure program
no
Has a bug bounty program
no
Requires third party authorization/connections
yes
Uses token rotation
no