Security & Permissions

The short version

• LeyA only publishes posts you approve on WhatsApp, right away or at the time you schedule.
• LeyA never sees your passwords. You log in on Facebook, Instagram, LinkedIn or TikTok's own page, and they give LeyA a revocable access token.
• LeyA cannot run or pay for ads, and does not ask for any ads permissions.
• Every access token is encrypted with AES-256 before it is stored.
• You can revoke access at any time from the platform itself, without asking us.

Exact permissions we request

These are the only permissions LeyA asks for. The platform shows the same list on its consent screen before you agree, and you can choose which Pages or accounts to share.

How your WhatsApp number is tied to your accounts

• Your LeyA account belongs to the WhatsApp number you sign up from. WhatsApp itself confirms which number each message comes from, so only that number can control your account.
• Sign-up also requires a verified email address. Disposable email addresses are refused.
• The links LeyA sends to connect an account are signed for your account only and expire within two days.
• Each login request carries a signed code that expires after 15 minutes, which stops anyone from attaching their account to yours.

How we protect your data

• TLS 1.3 encryption for all data in transit, with HSTS
• AES-256-GCM encryption for every Facebook, Instagram, LinkedIn and TikTok access token at rest
• Rate limiting and automatic blocking of scanners and abusive traffic
• Automated security tests and prompt security updates
• Hosted in Vultr data centers with physical security controls
• Automatic server backups

Who processes your data

How to revoke access

Removing LeyA on the platform stops access immediately, whatever happens on our side:

• Facebook: Settings & privacy → Settings → Business integrations → LeyA → Remove
• Instagram: Settings and activity → Website permissions → Apps and websites → LeyA → Remove
• LinkedIn: Settings → Data privacy → Permitted services → LeyA → Remove
• TikTok: Settings and privacy → Security and permissions → Apps and services → LeyA → Remove

To delete everything LeyA holds about you, follow the data deletion instructions.

If something goes wrong

If we confirm a security breach that affects your data, we will:

• Contain it straight away, including cutting off any exposed access tokens
• Email you within 72 hours of confirming it: what happened, what data was involved, and what we are doing about it
• Report it to the relevant data protection authorities where the law requires it

Report a security issue

Email info@leyagent.com with "Security" in the subject. We aim to reply within two business days and will keep you updated until it is fixed. Details are also in our security.txt.

We will not take legal action against good-faith security research that follows these rules:

• Only test against accounts you own, and never access, change or delete other people's data
• No denial-of-service, spam, social engineering or physical attacks
• Give us a reasonable time to fix the issue before making it public