Security & Trust
Sonaco is built on three principles: verifiability, minimal permissions, and your full control.
001
Verifiable Trust
Every permission is verifiable through your social network settings. You can always check exactly what we can do.
002
Minimal Access
We only request permissions necessary for publishing and analytics. Nothing more.
003
Instant Disconnect
Disconnect Sonaco in one click — through our settings or via the social network's API. Access is revoked instantly.
Encryption
Social media access tokens are encrypted. We never store your account passwords — authorization happens through each platform's official OAuth flows.
What we can and cannot do
You can verify these permissions in each social network's settings.
Telegram
- Publish posts to connected channels
- Retrieve channel statistics
- Edit published posts
- Read private messages
- Delete the channel
- Add or remove members
- View other people's channels
- Publish posts and stories
- Retrieve account statistics
- Read comments on posts
- Read direct messages
- Follow or unfollow accounts
- Delete the account
- Change profile settings
Data Storage
- Data is deleted within 30 days after account deletion
- If your subscription lapses, data is frozen but not deleted — you can come back
- Each workspace's data is isolated from others
Your Control
You can always manage Sonaco's access to your accounts:
- Disconnect a channel or account in workspace settings
- Revoke access in the social network's settings (Telegram BotFather, Instagram → Apps)
- Delete your account in profile settings — all data will be removed within 30 days
- Review the permissions list on the OAuth screen when connecting