Security and data handling

1. Hosting and infrastructure

UGC Agent is made of three hosted parts. The web app and its API at app.ugcagent.app run on Railway, including a scheduled worker that runs saved automations. This marketing site, ugcagent.app, is a static site served by Netlify. Account records, conversations, saved lists and settings are stored in Google Firebase (Cloud Firestore), and sign-in is handled by Firebase Authentication.

Every page and API endpoint is served over HTTPS. The marketing site sends a Strict-Transport-Security header, and also sets X-Content-Type-Options: nosniff, a strict referrer policy, and a frame policy that blocks embedding by other sites. Server credentials (database service accounts, provider keys, billing secrets) live in the hosting provider's environment settings, not in the browser bundle or the code repository.

The full list of service providers that process data on our behalf, including analytics, email and AI providers, is in section 6 of the Privacy Policy.

2. Sign-in and accounts

There are two ways to sign in: Google sign-in, or a passwordless magic link sent to your email address. Both go through Firebase Authentication. UGC Agent does not offer password sign-in, so there is no password database to protect, and your account is as secure as the Google account or inbox you sign in with. Turning on two-step verification for that Google account or mailbox is the single most useful thing you can do.

A small number of UGC Agent staff can open a customer workspace to investigate support requests and search-quality problems. That access is switched off unless a server-side secret is configured, and the secret is checked on the server with a constant-time comparison. It is never available from the browser alone.

3. Data access rules

Firestore security rules deny every read and write by default and then open only what a signed-in user needs:

• You can read and write only your own user record, conversations, saved creator lists and CRM data.
• The browser cannot change your plan, usage counters, API usage, billing state, team membership or attribution fields. Those are written by the server only.
• API keys, API request logs and quotas, usage ledgers, webhook settings, automation runs, and team and invitation records are server-only collections. No browser session can read or write them directly.

Public share links are created per list by the owner, can be turned off at any time, and leave out the CRM fields (stage, notes) and integration sync data.

4. Payments

Subscriptions are sold through Stripe Checkout, and plan changes, invoices and cancellation run through the Stripe billing portal. You type your card details into pages hosted by Stripe, so card numbers never pass through or get stored on UGC Agent servers. We keep only the Stripe customer and subscription identifiers, the plan, the billing period and the subscription status we need to apply your plan.

Stripe tells the app about payments through webhooks. The server reads the raw request body and verifies Stripe's signature against a signing secret before it acts on any event, and rejects anything that fails the check. The trial needs no card at all: it is a 3-day free trial, no card required. Plan details are on the pricing page.

5. API keys, MCP and webhooks

Developer API keys

The developer API is available on Ultra and Enterprise. Each key is generated on the server from a cryptographically secure random source and looks like ugc_live_ followed by a key id and a long random secret. UGC Agent stores only a SHA-256 hash of the key and a masked display value; the full key is shown once, when you create it, and cannot be retrieved later. Incoming keys are checked with a constant-time hash comparison.

• A workspace can hold up to 10 active keys, and any key can be revoked from Account, API.
• Requests are rate limited per key and per workspace (10 requests per minute by default) and return HTTP 429 when the limit is hit.
• Ultra includes 100 calls per day and 2,000 per month, counted on job-creating requests.

MCP access

On Premium and up, the MCP server lets an LLM client such as Claude or Cursor run searches in your workspace. Treat the private MCP connection URL and any key you paste into a client like a password, and revoke it if a device or client config leaks.

Outbound webhooks

Webhook deliveries from the API are signed with HMAC-SHA256 over the timestamp and the request body, sent in an X-UGC-Signature header as t=<timestamp>,v1=<signature>. Verify the signature and reject timestamps older than five minutes to block replays. Webhook URLs that point at private or internal network addresses are refused.

6. Connected tools

When you connect Instantly, Smartlead or Slack, the API key or access token you provide is encrypted at rest with AES-256-GCM (a random initialisation vector per value and an authentication tag), using an encryption key held only in the server environment. The app uses those credentials only to perform the action you asked for, such as pushing a creator list into a campaign. Disconnecting the integration deletes the stored credential.

UGC Agent never asks for your Instagram, TikTok or Meta login, and does not connect to your social accounts.

7. Team access

Premium workspaces can share access with up to 5 teammates and Ultra with up to 10. Every team has one owner; everyone else is a member. Invitations are tied to an email address: only a signed-in user whose verified email matches the invitation can accept it, and unused invitations expire after 14 days. Owners can resend or revoke pending invitations and remove members at any time; removing a member ends their access to the shared workspace and its plan.

8. Where creator data comes from

The UGC Database and every search are built from information creators publish themselves: public Instagram and TikTok profiles and posts, bios, public business emails, portfolio sites and public web pages. That data is retrieved through third-party data providers that read public pages. Accounts set to private are excluded from results. We do not buy leaked or scraped private data, and we do not log in to anyone's social account to collect it.

AI providers classify that public information (niche, content style, contact type) and score creator fit against your brief. Those scores are a first pass and can be wrong; the fit-scoring methodology explains how they work and section 5 of the Privacy Policy covers the AI processing in detail.

9. Creator removal

Every public creator profile page on this site has an "Is this your account?" panel with a Remove this profile link. It opens a pre-filled email naming the profile, and removals are honoured on the next build of the site and in the creator index the app searches. A creator without a profile page can email hello@ugcagent.app with the profile URL or handle and the platform.

After a removal we may keep a minimal identifier so the profile is not collected again. Removal from UGC Agent does not delete the content from Instagram or TikTok, or from lists a customer exported earlier. The for-creators page explains what brands see and how creators get found.

10. Deleting your data

You can delete individual conversations inside the app, and remove creators from your saved lists at any time. To close your account and delete its workspace data, email hello@ugcagent.app from the email address on the account. Billing records are kept for as long as tax and accounting law requires; the retention section of the Privacy Policy lists what is kept and why.

11. Certifications and questionnaires

UGC Agent does not hold SOC 2, ISO 27001 or similar certifications, and has not completed a third-party penetration test that we can share. Our infrastructure providers (Google Cloud and Firebase, Stripe, Netlify and Railway) publish their own compliance reports, which cover the layers they operate.

If your team needs a security questionnaire answered or a data processing agreement, email hello@ugcagent.app. Enterprise plans include custom contracts; see pricing or the Terms of Service for the standard terms.

12. Reporting a security issue

If you find a vulnerability, email hello@ugcagent.app with the subject "Security report", the steps to reproduce it and the impact you observed. Please do not access other customers' data, run automated scans that degrade the service, or publish the issue before we have had a reasonable chance to fix it. Security reports are read by the people who build the product, and we will tell you when a fix ships. There is no paid bug bounty.