Encrypted connection
All traffic between you and METRA AI runs over HTTPS/TLS. Nothing is transmitted in the clear.
Security
Security & data protection
METRA AI works with your channels, leads and content — so data protection is built into the platform at every level: encryption, strict authentication and data isolation between accounts. Here is how it works.
Encryption
Data encrypted in transit and at rest
Encryption at rest
Sensitive data — channel access tokens, sessions, contacts — is stored encrypted. Access keys to your channels are never kept in plain text.
Data isolation
Every account and workspace is strictly isolated. Users of one organization can't see another organization's data.
Access
Strict authentication and access control
Secure sign-in
Passwords are stored only as an irreversible hash (bcrypt) — not even we have them in the clear. Access is granted via short-lived tokens.
2FA and trusted devices
Two-factor authentication, new-device email confirmation and session-to-device binding. A sign-in from an unknown device is blocked until confirmed.
Roles and workspaces
Granular roles and permissions: each teammate only sees and changes what they're allowed to. Agencies keep client projects separate.
AI generation
Third-party AI models and protected generation
Third-party AI models
Text and images are created using third-party AI models. We don't disclose specific providers. Models receive only the context needed to generate a given post — nothing more.
Prompt-injection protection
Everything that reaches the AI is checked for attempts to hijack generation (prompt injection) and malicious payloads. Suspicious inserts are rejected.
Upload validation
Uploaded images are validated by file signature, not by extension — you can't smuggle an executable disguised as a picture.
Infrastructure
Reliability and monitoring
Monitoring and alerts
Errors and failures are tracked in real time — the team is alerted and reacts without waiting for complaints.
Continuous hardening
We regularly audit access, fix vulnerabilities and strengthen the service's defenses.
Rate limiting
Rate limiting and protection against automated attacks at the infrastructure level guard the service and your data.
Privacy
Your data belongs to you
Only what's needed
We collect the minimum data required to run the service, and use it only to make the platform work.
Data deletion
You can request deletion of your data at any time — just contact support.
We don't sell data
Your data and your subscribers' data are never sold or shared with third parties for marketing.
Found a vulnerability? Tell us
We value responsible disclosure. If you've found a security issue, reach out to support inside the app and we'll look into it promptly.