Security at MyraidReach

Protecting our clients' channels is the core of what we do. This page summarizes our controls.

Access to YouTube

Channels are connected only through Google OAuth 2.0 with PKCE. We never ask for, see or store Google passwords.
Least privilege: only youtube.upload and youtube.readonly. We cannot delete videos, manage comments or change channel settings.
One authorization per channel. The owner chooses the exact channel or Brand Account on Google's own screen.
Every upload needs an explicit, logged confirmation by a named team member on a review screen that shows the channel, visibility and metadata.

In transit: HTTPS/TLS for every connection, with automatically renewed certificates.
Tokens at rest: AES-256-GCM authenticated encryption with versioned keys (supports rotation). Each ciphertext is bound to its channel record. Keys are kept apart from the database.
Media at rest: video and thumbnail files are encrypted in 4 MiB AES-256-GCM chunks with a separate per-file key. Plaintext never touches disk. Files are deleted once YouTube accepts them.

Team passwords are hashed with Argon2id. Sign-in attempts are rate-limited. Sessions use HttpOnly, Secure, SameSite cookies.
Every form and upload request has CSRF protection. A strict Content-Security-Policy blocks inline scripts. Clickjacking is blocked.
Role-based access (admin and member), with an audit log of sign-ins, connections, confirmations, disconnections and deletions.
The database is isolated on a private network and is not exposed to the internet.

Grants are re-validated daily. Revoked grants trigger automatic data deletion.
YouTube API data is refreshed every 25 days, so it is never older than 30 days. Stale data is purged.
Disconnecting revokes the token at Google instantly and deletes the channel's data immediately.

Report a security issue: contact@myraidreach.com