OkayPost Sign in

For IT teams

Security, in plain words

For the IT team asked to allow OkayPost. OkayPost is a content calendar and approval tool for agencies: the team adds designs and videos from its storage to posts, and sends clients a link to approve them.

Ask us a security question

Last updated 9 October 2026

In short

Read only, and only what the team opens

Read only

OkayPost never edits, moves, renames, uploads to or deletes anything in your storage.

Only what the team opens

It lists a folder when someone on the team browses it in OkayPost, downloads a file when they add it to a post, and streams a video when someone plays it. It doesn’t scan or index your storage.

Tokens stay on our server

Sign-in tokens from a service are encrypted and never sent to a browser. Disconnect deletes them.

Permissions

What we ask each service for

Google Drive

  • drive.readonly
  • drive.file

A read-only Google account of ours opens only the folders or Shared drives you share with it as a Viewer. When someone chooses a folder in Google’s own folder chooser, OkayPost uses their Google sign-in with drive.file (only files the app creates or they pick), only while they do it, to share that folder with our account. That sign-in isn’t kept. A folder can’t be connected from its link alone: our server first checks with Google that the person choosing it can open it.

Google Calendar

  • calendar.freebusy
  • calendar.events.readonly

Only if a person chooses, in My day, to show their own busy times: their browser asks Google when they are busy in the next 60 days (start and end only, never a title, place or guests), with their own sign-in, only while they press it. That sign-in isn’t kept.

calendar.events.readonly only if a person chooses, in Settings › Time off, to bring their days off from Google Calendar: their browser lists their own Out of office events from a month back to a year on, and only the days they tick go to OkayPost as time-off requests. Nothing is written to their calendar, and that sign-in isn’t kept.

OneDrive and SharePoint

  • Files.Read.All
  • Sites.Read.All
  • User.Read
  • offline_access

Through Microsoft Graph. All read permissions: User.Read for the account’s name, offline_access to stay connected. If your tenant requires it, an administrator approves the app once.

Box

  • root_readonly
  • root_readwrite

Box lets an app download a file only with its write permission, so OkayPost asks for it, but nothing in OkayPost writes to Box.

Dropbox

  • account_info.read
  • files.metadata.read
  • files.content.read

All read permissions.

Figma

  • file_content:read
  • current_user:read

Read only. When the team pastes a frame’s link, OkayPost asks Figma for that frame as a picture and adds it as a design. It never changes your Figma files.

Canva

  • design:meta:read
  • design:content:read
  • profile:read

Read only. When the team pastes a design’s link, OkayPost asks Canva to export that page as a picture and adds it as a design. It never changes your Canva designs.

OneDrive, Box and Dropbox give access to what the signed-in account can open, not to one folder. OkayPost opens only the files the team browses and adds.

Data

What we keep, and where

  • For each design added: a smaller copy for review (up to 1400 pixels wide), a thumbnail, and which file it came from. The original stays in your storage.
  • Videos from your storage aren’t copied: they play from it, through our server.
  • The posts, captions and feedback written in OkayPost. The full list is in our privacy policy.
  • OkayPost runs on Cloudflare. The database is in Europe (Milan); the picture copies and uploaded videos are stored in Eastern Europe; a daily copy of the database is kept 30 days in Western Europe. Cloudflare encrypts this data at rest. To load pictures quickly, Cloudflare may keep temporary copies in data centers near the people viewing them. Reading your storage goes through the service’s own servers.

Access

How access is protected

  • Everything is served over HTTPS only.
  • The team signs in with a one-time code sent by email. Codes are kept only as a one-way hash and work for 10 minutes; sessions are in a secure, HttpOnly cookie.
  • Each agency’s workspace is separate: our server checks the workspace on every request, and a folder belongs to one workspace only.
  • Each agency’s posts, comments and activity are kept in a database of its own, apart from every other agency’s. Sign-in, accounts and review links stay in a shared database, so the server can tell which agency each request is for.
  • Roles limit what each person sees: account managers and designers see only the clients they are on.
  • A client’s review link opens only that client’s posts, never the storage browser. To comment or approve, each person confirms their email with a code.

Removing access

Turn it off at any time

  • In OkayPost: Storage › Disconnect deletes the stored tokens.
  • In the service: stop sharing the folder with OkayPost’s Google account, or remove OkayPost from the connected apps in your Microsoft, Box or Dropbox admin console or account settings.
  • To have a workspace’s data deleted, write to us from the workspace owner’s address.