Clariturn never collects your Instagram password
How Instagram connection works
Clariturn connects to your Instagram account exclusively through Meta's official OAuth 2.0 authorization flow. This means:
- You are redirected to Meta's official authorization page to grant access
- We never see your Instagram password at any point
- You can revoke access at any time from your Instagram settings or our Settings page
- We receive only a limited-scope access token authorized for the specific permissions you granted
Data protection measures
Encryption in transit
All data between your browser and our servers uses TLS (HTTPS), enforced with HSTS.
Encryption at rest
Your Instagram access token and two-factor secrets are encrypted with AES-256-GCM before being stored; the database itself is hosted on encrypted storage in the EU (Frankfurt).
Strong passwords & sign-in
Passwords are hashed with bcrypt and never stored in plaintext; we check new passwords against known-breached lists, and offer app-based two-factor authentication (TOTP) with recovery codes.
Session protection
Sign-in uses signed, HTTP-only cookies; changing your password invalidates all other sessions, and idle sessions time out automatically.
Abuse & brute-force protection
Authentication and other sensitive endpoints are rate-limited, and state-changing requests are protected against CSRF.
Data minimization
We request only the Instagram API permissions needed for the features you use — never broad account access.
Access control & secrets
Access to production data is restricted and logged; all keys and secrets live in environment variables, never in source code.
What we do not do
- We do not store your Instagram password
- We do not use unofficial Instagram APIs or scraping tools
- We do not access data beyond what you explicitly authorized
- We do not share your data with third parties for advertising purposes
- We do not automate any Instagram actions on your behalf
Responsible disclosure
If you discover a security vulnerability in Clariturn, please report it responsibly to:
security@clariturn.com
Please include a description of the vulnerability and steps to reproduce it. We will acknowledge receipt within 48 hours and aim to resolve confirmed issues as quickly as possible. We ask that you give us reasonable time to address the issue before public disclosure.