Founders tell you things they would not post. We treat it that way.

Who can see what

An agency is an organisation. Its operators are invited by email and carry a role (owner, admin, writer). A client’s people are listed against that client only: an approver sees the client’s posts and decides; a contributor sees them and sends material. Every read and every write on the server checks that the caller belongs to the agency, or is one of that client’s people. Anything else is not found. One agency’s clients are invisible to another agency.

Sign-in

No passwords, for anyone. A six-digit code is emailed and expires in ten minutes; five wrong attempts end it. Sessions last thirty days and are refreshed daily. Code requests are rate-limited per IP address (three a minute) with the counters kept in the database, so the limit holds across every instance.

Private material

Your writer marks each piece of a founder’s material as public, private, or needing clearance. Private material never reaches a draft: the check is in the workflow, not in a guideline. Under every post the founder can see exactly which part of what they said was used.

Publishing

Approved X posts are published from the founder’s own account, which they connect themselves through X’s authorisation (OAuth 2.0 with PKCE; scopes limited to reading their profile and writing posts). Nothing is posted without an explicit client approval or an owner-configured Auto-approve policy plus a writer explicitly marking the draft ready, and nothing before its scheduled slot. The tokens X issues are encrypted at rest (AES-256-GCM, key derived from the instance secret), never returned to the browser, and revoked at X when an account is disconnected. LinkedIn offers no posting API to agencies; LinkedIn posts are published by hand and marked.

Where the data lives

On your own server, if you want it there: Thinked ships as one container with one database file, and the deployment guide covers backups. Or on ours, in the EU. In both cases the database is one file you can copy, inspect, and take with you.

The browser

Every page is served with a Content Security Policy that only allows our own origin, frame-ancestors none, strict transport security, and a referrer policy that keeps client page addresses out of third-party logs. Analytics and error reports, when enabled, leave through our own origin.

What we do not do

• We do not publish to any social network.
• We do not train models on client material, and we do not send it to model providers.
• We do not sell, share, or enrich the data with third parties.
• We do not show our name on the pages a founder opens.

Honest limits

Thinked is not SOC 2 or ISO 27001 certified. It is a small product run by a small team. If your agency needs a certification, a data-processing agreement, or a security questionnaire completed, write to hello@thinked.so and a person will answer.