Skip to content

Early access: paid plans open soon. Get an emailPaid plans and posting to Facebook and Instagram open as soon as Meta finishes reviewing our app.

Bold Beluga
Try it free

Security

Last updated October 21, 2026

Bold Beluga posts to your business's social accounts, so we take keeping your account and data safe seriously. This page describes how we protect it today. Bold Beluga is run by Helstad Digital (org. no. 838 699 472), Alexander Helstad's sole proprietorship in Norway.

Encryption

  • Every connection to Bold Beluga uses HTTPS.
  • The access tokens that let us post to Facebook, Instagram and LinkedIn, and the read-only key a WooCommerce store gives us, are encrypted with AES-256-GCM before they are stored, and are only decrypted on our servers when a post goes out or results are read.
  • Your Canva connection is stored the same way, and is only decrypted when you bring in a design or edit in Canva.
  • Passwords are stored only as a secure one-way hash. Nobody, including us, can read your password.

Signing in and teams

  • You can sign in with an email and password, or with Google so we never handle a password at all.
  • If you invite teammates, each gets their own login and a role (owner, admin, editor or viewer) that limits what they can do. Remove someone and their access ends at once.
  • AI assistants you connect get access only after you sign in and approve them, and you can remove that access at any time in the assistant.

Payments

Payments are handled by Stripe on its own secure page. Your card number never reaches our servers.

Where your data is stored

Our app and files run on Vercel and our database on Neon, both in the United States. To write posts and create images and video clips, we send the content each request needs to Anthropic, OpenAI and fal.ai. The full list of providers is in our privacy policy.

Your content stays yours

We never use your content (your website text, photos, logo, your store's products and sales, and the posts we make for you) to train AI models, and we never show it to other customers. Usage data, such as which posts are approved or skipped and how they perform, is only used to improve the service combined with other customers' data and anonymized. The privacy policy explains the difference.

Platform access

We only ask Facebook, Instagram and LinkedIn for the permissions Bold Beluga needs to publish, show results and comments, and run ads you turn on. We never read your private messages. An online store you connect is only ever read, never changed: a WooCommerce store gives us a read-only key, and we ask it for products and order totals, not your customers' details. You can disconnect any account or store at any time in Bold Beluga, and we delete its stored access right away.

Google Drive opens in Google's own picker, and we can only see the photos you pick there, never the rest of your Drive. Canva gets only what it takes to list your designs, export the ones you pick, and open a post in Canva for you.

Deleting your data

You can delete a brand or your whole account yourself, and it's deleted right away. See Delete your data.

Report a security problem

If you think you've found a security problem in Bold Beluga, email alexander@boldbeluga.com. Please give us time to fix it before you share it publicly, and don't access other people's data or disrupt the service while testing. We'll reply as soon as we can and tell you when it's fixed. Our security.txt has the same contact.