Security
Security controls for a sensitive workflow.
FollowerSpike handles identity, billing, AI output, and LinkedIn session material as sensitive data.
Last updated: May 15, 2026
Encrypted Sessions
LinkedIn session payloads are encrypted server-side with AES-256-GCM and are never exposed to client components.
Least Privilege
The database is reachable only by the application server; there is no public data endpoint and no browser-held database key. Every query is scoped to the signed-in user in server code, and Clerk verifies the session before any of it runs.
Verified Integrations
Clerk, Razorpay, and QStash requests are all signature-verified before processing, and every one of them fails closed: a missing header, an absent signing key, or a body that does not match is rejected rather than trusted. The job runner is reachable only with a valid QStash signature, so a deployment with no signing keys configured cannot be driven over HTTP at all.
Audit Trail
Every attempted, skipped, paused, failed, and successful automation action is stored with a reason code and timestamp.
FollowerSpike is not affiliated with, endorsed by, or certified by X, LinkedIn, or Bluesky. FollowerSpike publishes and reads only through each platform's official API, under permissions you grant and can revoke at any time. Lead magnet delivery is by email only, sent to an address the recipient supplies in their own reply, and is subject to daily caps you control.