Security

Updated 15 October 2026

How Spread the Word protects your accounts, your credentials and the communities you post in.

Platform credentials

Encrypted with AES-256-GCM. Each account has its own data key, which is encrypted with a master key held in a separate secrets store (HashiCorp Vault), never in the database.
Decrypted only at the moment of publishing, or when a member’s computer asks for a credential to post that one item. Every decryption is recorded in the audit log.
Never shown again after you save them, and never returned by the API or to your agent.

Spread the Word’s servers run no AI models and send your data to no AI provider. Reasoning happens in Claude Code, Codex or OpenCode on your computer.
scx starts each agent in an empty temporary folder with only the Spread the Word tools, web search and web fetch. Shell commands and file edits are not allowed.
Each job gets a short-lived token limited to that job’s project, revoked when the job ends.

Sign-in is through your Steady Circuit account. Personal API tokens are stored only as keyed hashes and can be limited by scope and revoked at any time.
Every change records who made it in an audit log.
Redirect-link clicks store a hash of the visitor’s IP address salted per day, so visitors cannot be followed across days and raw IP addresses are never stored.

Disclosure of your affiliation is on by default for every persona. Switching it off needs an explicit, recorded acknowledgement.
Pacing limits, promotional caps and each place’s rules are checked before anything is posted.
There are no voting, boosting or sock-puppet features, and two of your personas cannot take part in the same thread without a recorded override.
Spread the Word’s own crawler identifies itself, respects robots.txt and paces its requests. See our crawler.

Spread the Word runs on servers in the European Union (Hetzner, Germany). Data is encrypted in transit with TLS.

Email hello@steadycircuit.com with the details. Please do not test against other people’s accounts.