Trust & Security

TRIGMAZE holds real Instagram access tokens and real conversation data on behalf of creators and small businesses. Here is exactly how that data is protected, run by PAIDGUY DIGITAL SERVICES — not a claim, a description of what’s actually deployed today.

Encryption

• Every Instagram access token is encrypted at rest, using industry-standard encryption, before it touches the database — never stored in plaintext.
• All traffic to and from TRIGMAZE is TLS-encrypted end to end, via an auto-renewing certificate terminated on infrastructure we operate directly, not a shared proxy.
• HSTS, a strict Content-Security-Policy, X-Frame-Options, and the other standard security response headers are set on every response.

Account security

• Two-factor authentication (TOTP) and passkeys (WebAuthn) are both available on every account.
• New and changed passwords are checked against a breached-password database — a known-compromised password is rejected outright.
• Login and password-reset endpoints are rate-limited specifically against credential-guessing, on top of general request rate limiting.
• You can view every active session (device, IP, date) and revoke any of them individually, or all at once, from Settings.

Backups & infrastructure

• The production database is backed up nightly to a separate, geographically distinct storage location — a single provider outage can’t take the backups down with it.
• Backup failures alert us directly by email — a silent failed backup is treated as an incident, not a background job we hope worked.
• The application runs on infrastructure we operate directly, not a shared third-party SaaS backend. Our database is located in Singapore — see the Privacy Policy for why, and what that means for cross-border data transfer.

Outbound webhooks (flow-builder integrations)

If you connect a flow to an outbound webhook (Zapier, Make, Google Sheets via Apps Script, or your own endpoint), TRIGMAZE actively blocks that webhook from being pointed at a private, internal, or loopback address — a safeguard against a webhook URL being used to reach infrastructure it was never meant to touch, not just a policy against it. A webhook call that fails or times out never blocks or breaks the rest of your flow — a broken third-party endpoint can’t take your automation down with it.

Sending limits

Instagram caps automated private replies at 750 per hour, per connected account — TRIGMAZE paces every send to stay under that automatically. A broadcast that hits the ceiling automatically resumes once the hour’s limit refills; a real-time comment or DM reply that’s rate-limited shows as a failed send you can retry, never a silent drop.

Operational transparency

See our status page for real uptime signal and any current or past incidents — a live feed from the app itself, not a marketing claim.

Data handling

What we collect, why, and how to get it deleted is covered in full in our Privacy Policy and DPDP disclosure. In short: we don’t sell data, we don’t send message content to any third-party AI or analytics service, and account deletion is real and self-serve from Settings.

Responsible disclosure

Found a real security issue? Email [email protected] with enough detail to reproduce it. We’ll acknowledge within 2 business days and keep you updated as we investigate and fix it — please give us a reasonable window to patch before disclosing publicly, and avoid accessing or modifying data that isn’t yours while testing. We don’t currently run a paid bug-bounty program, but we’ll credit a genuine, responsibly reported finding if you’d like.

Questions

Security concerns, responsible disclosure, or a pre-sales security questionnaire — email [email protected].