# Security

How Spread the Word protects your accounts, your credentials and the communities you post in.

## Platform credentials

- Encrypted with AES-256-GCM. Each account has its own data key, which is encrypted with a master key held in a separate secrets store (HashiCorp Vault), never in the database.
- Decrypted only at the moment of publishing, or when a member’s computer asks for a credential to post that one item. Every decryption is recorded in the audit log.
- Never shown again after you save them, and never returned by the API or to your agent.

## Your AI agent

- Spread the Word’s servers run no AI models and send your data to no AI provider. Reasoning happens in Claude Code, Codex or OpenCode on your computer.
- scx starts each agent in an empty temporary folder with only the Spread the Word tools, web search and web fetch. Shell commands and file edits are not allowed.
- Each job gets a short-lived token limited to that job’s project, revoked when the job ends.

## Your account

- Sign-in is through your Steady Circuit account. Personal API tokens are stored only as keyed hashes and can be limited by scope and revoked at any time.
- Every change records who made it in an audit log.
- Redirect-link clicks store a hash of the visitor’s IP address salted per day, so visitors cannot be followed across days and raw IP addresses are never stored.

## The communities you post in

- Disclosure of your affiliation is on by default for every persona. Switching it off needs an explicit, recorded acknowledgement.
- Pacing limits, promotional caps and each place’s rules are checked before anything is posted.
- There are no voting, boosting or sock-puppet features, and two of your personas cannot take part in the same thread without a recorded override.
- Spread the Word’s own crawler identifies itself, respects robots.txt and paces its requests. See [our crawler](https://spread-the-word.steadycircuit.com/bot).

## Hosting

Spread the Word runs on servers in the European Union (Hetzner, Germany). Data is encrypted in transit with TLS.

## Reporting a vulnerability

Email hello@steadycircuit.com with the details. Please do not test against other people’s accounts.

Updated 2026-10-15. Canonical page: https://spread-the-word.steadycircuit.com/security