Security & privacy

Your name is on every post. We treat it that way.

Two things can hurt a small business online: someone getting into your accounts, and something untrue going out under your name. Townlight is built to guard against both.

How we protect you

The safeguards, in plain words.

Nothing posts without a person

Every post goes from draft to review to approval to scheduled. Only approved, scheduled posts are published, at the time a person chose, and every step is logged.

We never store social passwords

When you connect Facebook, Instagram, Google or LinkedIn, it's through their own sign-in. Townlight keeps only an access token, encrypted with AES-256-GCM, and you can disconnect at any time.

Your data stays in your business

Every record belongs to one business and every lookup is limited to it. Nobody at another business can see your posts, photos, team or customers.

Sign-in done right

Passwords are hashed with scrypt, never stored as typed. Reset and invitation links work once and expire. Changing your password signs out every other device, and you can sign out everywhere yourself.

Careful with uploads

Images are re-encoded, SVG files are stripped of scripts, and every file is served from a sandbox that can't run as the app. Menus and documents you teach Townlight are reference only and can never change its instructions.

Locked-down edges

Rate limits on sign-in, uploads and writing. When Townlight fetches a web page you asked for, it refuses private network addresses. Strict security headers on every page.

Honest AI

It isn't allowed to make things up.

General AI tools will happily invent a discount, a five-star review or an award. Townlight writes inside fixed rules and checks its own work before you see it.

  • Safety rules come first, and no document, web page or request can override them
  • Posts use only what you typed and what's in your records; unknown details stay out
  • Every draft keeps a list of the facts it used and where each came from
  • The brand check flags numbers and claims your records don't support before you approve
  • People are featured only from team profiles your business created; Townlight never looks people up

Where your data lives

Simple answers for whoever does your IT.

  • Hosted, or on your own servers

    Use Townlight's hosted service, or run the same Docker image on your own PostgreSQL database and file storage.

  • Yours to export

    Your posts, photos, team profiles, products and everything you taught Townlight belong to your business and are yours to export, including for 30 days after you leave.

  • Backed up daily

    The database is backed up every day in a consistent snapshot that can be restored to a fresh server.

  • A record of who did what

    Sign-ins, writing, approvals, publishing, connected accounts and settings changes are logged with who, what and when.

Our promises

Things we will never do.

These aren't settings you have to find. They're how Townlight is built.

  • Won't: Publish anything without a person approving it
  • Won't: Store your social media passwords
  • Won't: Sell your data, or your customers' data
  • Won't: Use your posts, photos or documents to train AI models
  • Won't: Use private information about real people; team posts come only from profiles your business created
  • Won't: Scrape websites against their terms; we only fetch public pages someone asked us to read
  • Won't: Email your newsletter subscribers for anything but your newsletter, and every email has a one-click unsubscribe

Questions about security?

We're happy to walk you, or whoever looks after your IT, through how Townlight works and where your data goes.

Start free trial Contact us
Security & privacy · Townlight