Skip to content
SignalbyStorytime
Start free

Last updated 9 September 2026

Signal security

Signal stores Instagram credentials, public post data and private messages sent to connected accounts. These are the controls protecting them.

  1. Protected sign-in

    Signal supports email links, Google sign-in and passwords stored as secure hashes. Sign-in links expire after 30 minutes and work once. Session cookies are HTTP-only and scoped to Signal.

  2. Hashed API tokens

    Signal shows each token once, stores its SHA-256 hash and lets you set an expiry or revoke access.

  3. Permissioned writes

    Tokens start with read access. Write access is granted per token, while REST remains read-only.

  4. Platform rules enforced

    Signal checks Instagram’s reply window, comment permissions and rights-request eligibility on the server.

  5. Verified inbound webhooks

    Signal verifies Meta webhook signatures before processing each payload.

  6. Signed outbound webhooks

    Outbound deliveries use timestamped HMAC-SHA256 signatures. Registered endpoints must use HTTPS.

  7. Data preservation

    Visibility and access can change without physically deleting stored records or media.

  8. Workspace export

    Export your workspace and download mentions or creators as CSV before closing the account.

  9. Operational visibility

    Authorized staff can review processing jobs and failures to operate the service, with sensitive error details removed from customer-facing responses.

Disclosure

Report a security issue

Email [email protected] with steps to reproduce the issue. We will acknowledge the report and share next steps.

Do not access other customers’ accounts or run scans that disrupt the service. Please allow a reasonable remediation window before public disclosure. Signal does not offer a paid bounty.

If the issue appears to involve Instagram or Meta, include that context so we can assess Signal’s exposure.

Worth knowing

  • Signal is not SOC 2 or ISO 27001 certified.
  • Contact us if you need a data processing agreement or security questionnaire.
  • Contact us before signup if you have data-residency requirements.

More on what is collected and why is on the privacy page.