> ## Documentation Index
> Fetch the complete documentation index at: https://docs.postqueen.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> How she authenticates with each social network, and where your tokens live

Before you connect a real account you want to know what happens to the keys. This is that answer,
in the detail a security or platform review asks for.

## How she connects

|                                                  |                                                                                                                                                                                       |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Official OAuth, where the platform offers it** | You log in on the platform's own screen and approve the scopes. She receives only what you approved                                                                                   |
| **Publishing and analytics APIs**                | No headless browser, no crawling, no scraping                                                                                                                                         |
| **A credential, where OAuth does not exist**     | Bluesky app password, WordPress application password, Nostr key. Lemmy and Listmonk take the account's own username and password, because that is what those instances accept         |
| **One cookie-based exception**                   | Skool has no public API, so it uses your own browser session through the [Chrome extension](/configuration/chrome-extension). Opt-in, and it carries its own terms-of-service warning |
| **Open source and self-hostable**                | Run her on your own infrastructure and read every line that touches your accounts                                                                                                     |

## Where credentials live

<Warning>
  **The two are not stored the same way, and the difference matters for a review.**

  Anything **you type in** is encrypted with AES-256 before it reaches the database: the credentials
  above, the Skool session cookie, your organization's API key, and the client secrets of any OAuth
  app you register.

  Tokens the **platform issues** through an OAuth flow are stored as the platform returned them. For
  those the database is the security boundary, so encrypt the volume and keep access to it narrow.
</Warning>

## What that means for you

<CardGroup cols={3}>
  <Card title="On the cloud" icon="cloud">
    The token is issued by the platform through its own screen, carrying only the scopes you approved
  </Card>

  <Card title="Self-hosting" icon="server">
    Tokens and post content live where you put them, and the boundary above is yours to act on
  </Card>

  <Card title="Building on top" icon="code">
    The [API](/public-api/introduction) and [MCP](/mcp/introduction) use the same authenticated flows and the same platform limits
  </Card>
</CardGroup>

Storage settings and `ENCRYPTION_KEY`: [Configuration reference](/configuration/reference). Setting
up your own provider credentials: [OAuth configuration](/configuration/oauth).

## Reporting a concern

<Info>
  Believe an integration violates a platform's terms, or found a security problem? Email
  **[support@postqueen.ai](mailto:support@postqueen.ai)** with the details and the team will investigate.
</Info>