Security Overview
This overview describes the security and privacy controls Pomeg uses to protect account data, connected social accounts, access credentials, lead conversations, and AI-assisted workflows. It is intended for customers evaluating Pomeg's current security posture and shared-responsibility model.
1 Security scope
Pomeg's security program is designed around data minimization, protected credentials, controlled workspace access, privacy-filtered analytics, and limited disclosure to providers that are necessary to operate the Services. Controls apply to the Pomeg web application, backend services, databases, integrations, and production operations managed by Pomeg.
No security measure eliminates all risk. This overview is informational and does not create a warranty, service level, or certification. A signed agreement controls if it contains different security commitments.
2 Hosting and data location
Pomeg hosts its production application, backend services, and primary databases on Railway infrastructure in the United States. Railway provides the underlying compute, networking, storage, and environment controls. Pomeg selects U.S. deployment regions for its hosted production workloads.
Pomeg's use of U.S. hosting does not mean every provider processes data only in the United States. Connected platforms, payment services, email services, and AI providers may process limited data in other locations under their own infrastructure and contractual terms. International processing is addressed in the Pomeg Privacy Policy.
3 Encryption credentials and secrets
Network transport. Pomeg uses HTTPS and TLS for traffic between users and the Services. Railway also supports encrypted private networking between services in an environment.
Passwords. Pomeg does not store account passwords in readable form. Passwords are protected using one-way salted hashing or an equivalent managed authentication control.
Integration tokens. OAuth access tokens, refresh tokens, API credentials, and comparable secrets are encrypted at rest and are decrypted only when needed for an authorized integration request.
Secret handling. Production secrets are kept in protected runtime configuration rather than client-side code or analytics events. Access is limited to systems and personnel that need the secret for service operation.
Payment credentials. Whop and its financial partners process payment credentials. Pomeg does not ordinarily receive or store full payment card numbers.
Pomeg does not disclose passwords or integration tokens to advertising or analytics providers. An integration token is transmitted to the platform that issued it, such as Meta, and is processed by the infrastructure required to store and execute the authorized connection.
4 Workspace and production access
Pomeg separates customer workspaces logically and enforces workspace membership and role checks in the application. Workspace owners and administrators control invitations, removals, connected accounts, and user roles. Customers are responsible for assigning the least access each team member needs and for promptly removing former members.
Pomeg restricts production access to authorized personnel with an operational, support, legal, or security need. Personnel access to Customer Content is limited to the purpose requiring access. Support access is not a substitute for a customer's own workspace permission management.
5 Privacy preserving analytics
Pomeg filters analytics events before they are sent to an analytics provider. Direct identifiers, access tokens, message bodies, lead conversations, and customer-provided text are excluded. Analytics tools receive limited event data needed to measure feature use, reliability, errors, and performance.
Pomeg does not permit analytics providers to build advertising profiles from Pomeg Customer Content. Operational logs may contain technical identifiers and request metadata needed for security and troubleshooting, but Pomeg configures logging to avoid storing message content and secrets where they are not needed.
6 AI data controls
Pomeg uses OpenAI and Anthropic commercial APIs for AI features. For each request, Pomeg limits the transmitted material to the instructions and context needed to perform the selected task.
Automated redaction is applied before transmission to remove direct identifiers such as names, handles, email addresses, phone numbers, and account identifiers.
Pomeg does not intentionally send passwords, integration tokens, billing credentials, or full lead profiles to an AI provider.
Pomeg does not opt in to provider training on Pomeg API inputs and outputs and does not use private messages to train a general Pomeg model without separate express permission.
AI context is used to produce the requested output. Although direct identifiers are removed, contextual text can still qualify as personal data and remains subject to Pomeg's privacy and access controls.
7 Core service providers
Pomeg limits provider access to the data and purpose necessary for the provider's function. The following table describes the core provider relationships covered by this overview.
Provider | Purpose | Data handling |
Railway | U.S. application hosting, networking, databases, storage, and runtime secrets. | Processes encrypted or access-controlled production data as Pomeg's infrastructure provider. |
Meta and Instagram | Account authorization, social messaging, comments, media references, and platform events. | Receives integration credentials and communications needed for the customer-authorized connection. |
Whop and financial partners | Checkout, subscription billing, payment processing, fraud, disputes, and tax functions where applicable. | Receives payment and billing information; Pomeg receives limited subscription and transaction records. |
OpenAI | AI inference for enabled or invoked features. | Receives minimized context after automated direct-identifier redaction; Pomeg does not opt in to general model training. |
Anthropic | AI inference for enabled or invoked features. | Receives minimized context after automated direct-identifier redaction; Pomeg does not opt in to general model training. |
Analytics provider | Feature adoption, performance, and reliability measurement. | Receives privacy-filtered events without direct identifiers, message content, lead conversations, or access tokens. |
Pomeg may replace or add providers as the Services develop. A replacement must receive only the data reasonably necessary for its function and must be subject to privacy and security obligations appropriate to the data it processes.
8 Data lifecycle and deletion
Pomeg keeps credentials and Customer Content only while they are needed for the connected account and Services, subject to legal obligations and limited backup cycles. Disconnecting Instagram stops future collection through that integration. A verified deletion request causes Pomeg to revoke or delete the relevant token and delete or de-identify covered data from active systems unless retention is legally required.
Deletion may not immediately remove isolated backup copies. Those copies are not used for ordinary product activity and are overwritten or deleted through the applicable backup lifecycle. The Privacy Policy explains retention criteria and the deletion request process.
9 Monitoring incident response and notification
Pomeg monitors the Services for reliability, errors, misuse, and indicators of unauthorized access. When Pomeg identifies a suspected security incident, it assesses the scope, contains the issue, protects credentials and systems, preserves relevant evidence, restores safe operation, and evaluates notification duties.
Pomeg will notify affected customers and authorities when required by applicable law or a written agreement. Notification timing depends on confirmation, investigation, law-enforcement restrictions, and the information needed to provide a useful notice. Customers should report suspected account compromise or unauthorized activity promptly to privacy@pomeg.ai.
10 Customer security responsibilities
Security is shared between Pomeg, its infrastructure providers, connected platforms, and each customer. Customers should:
Use a unique password and protect the email or identity account used to sign in.
Invite only authorized team members, assign appropriate roles, and remove access promptly.
Secure connected Instagram and Meta accounts and review their administrators and login sessions.
Do not place payment card data, passwords, government identifiers, health data, children's data, or other specially regulated information in messages, notes, prompts, or automations unless Pomeg has expressly agreed that the Service supports it.
Review AI output and automation behavior before enabling customer-facing actions, and monitor active automations.
Keep devices and browsers updated and report suspicious messages, token exposure, or unauthorized workspace activity promptly.
11 Responsible security reporting
To report a suspected vulnerability, email privacy@pomeg.ai with a description, affected URL or feature, reproduction steps, and the potential impact. Do not access another person's data, disrupt the Services, use social engineering, publish a vulnerability before Pomeg has had a reasonable opportunity to investigate, or retain data obtained during testing. Pomeg does not promise a reward unless a written bounty program expressly applies.
12 Security and privacy contact
Security questionnaires, privacy questions, deletion requests, incident reports, and responsible vulnerability reports may be sent to:
Pomeg, Inc.
1111B South Governors Avenue
Suite 48579
Dover, Delaware 19904
United States
Email privacy@pomeg.ai