Consent before queueing
Recipient eligibility is resolved before the send operation is created.
Security
Trust starts with a clear record of who decided what.
PostDesk preserves the audience decision, operator action, provider response, and workspace boundary around every send.
Principles
Security follows the operation from audience to outcome.
Provider credentials stay scoped
Connections use the minimum provider access needed for the configured operation.
Outcomes keep their source
Every delivery state is labeled with the provider that reported it.
The checks happen before the handoff.
PostDesk validates the workspace, audience, message, and provider before it hands the message to the provider.
- 01WorkspaceThe campaign, template, audience, provider connection, and queue item all carry the workspace that owns them.
- 02AudienceKnownry must return current campaign consent, and PostDesk applies suppressions while the queue is built.
- 03MessageThe template must render, have a subject, and provide every required variable before launch.
- 04ProviderOnly an active connection from the same workspace can hand off the prepared message.
Provider secrets are encrypted at rest.
API keys and webhook secrets are stored as encrypted envelopes. The dashboard shows only the connection details, and a key is decrypted only when the provider adapter needs it for an operation.
Provider updates are verified before use.
Supported webhook signatures and timestamps are checked before an event changes message state. Provider event identifiers make a valid retry count exactly once.
Security still has a shared owner.
PostDesk protects the product workflow. Your team still controls who belongs in the workspace, which provider account is connected, and which operators are allowed to launch campaigns.
- Remove workspace access when a team member leaves or changes role.
- Rotate provider keys and webhook secrets through the provider and PostDesk connection.
- Review campaign consent, audience, and provider settings before every launch.