# Tamanor — full knowledge export > Tamanor is a Social Account Firewall: it monitors comments and reviews across connected social accounts, detects spam, scams and harmful behavior with AI risk detection, and prepares safe moderation actions that a human approves. Read-only by default, multi-tenant with row-level security and a full audit log. Origin: https://tamanor.com · Last updated: 2026-07-13 ## What is Tamanor? URL: https://tamanor.com/platform/what-is-tamanor Tamanor is a Social Account Firewall that monitors comments and reviews on connected social accounts, detects risk with AI, and prepares safe moderation actions a human approves. ### A firewall for your social presence Tamanor connects to the social accounts a brand already owns and continuously reads their comments and reviews. It classifies each item for risk — spam, scams, harassment, and repeated risky behavior — and surfaces what needs attention. Tamanor is read-only by default. When a moderation action is appropriate, Tamanor prepares it and a human approves it before anything happens on the platform. It never posts, replies, or deletes on its own. ### Who it is for Brands, agencies, e-commerce shops, creators and local businesses that receive public comments and reviews and need to protect their reputation without watching every channel by hand. ### FAQ Q: Does Tamanor post or reply on my behalf? A: No. Tamanor is read-only by default and only prepares actions; a human approves every moderation action before it runs. Q: Which accounts can Tamanor protect? A: Facebook Pages are live and verified. The Instagram Professional connector is implementation-complete but verification-pending, and Google Business is a foundation pending approved API access. It connects only through official OAuth. ## How Tamanor works URL: https://tamanor.com/platform/how-tamanor-works Tamanor connects via official OAuth, reads comments and reviews on a schedule and via webhooks, classifies risk with AI, and routes proposed actions through a human approval queue. ### Connect You connect an account through the platform's official OAuth flow. Tamanor stores only OAuth tokens (encrypted at rest in production) — never a password, and it never scrapes. ### Monitor A background worker reads new comments and reviews on a schedule, and webhooks deliver near-real-time events. Every fetched item is normalized and deduplicated so the same comment is never processed twice. ### Detect & propose Each item is classified by a hybrid engine (brand rules plus AI risk analysis) into a risk level and category. High-risk items can generate a proposed action, but Tamanor only proposes — it never executes automatically. ### Approve Proposed actions wait in an approval queue. A reviewer with the right role approves or rejects. Only Facebook comment hiding is enabled as a live action today, and only after approval, with the whole flow written to an immutable audit log. ### FAQ Q: How fresh is the data? A: Scheduled reads plus webhook events. Polling and webhooks are deduplicated, so coexistence never creates duplicate items. Q: What actions can Tamanor take? A: Today, controlled Facebook comment hiding after human approval. Everything else is monitoring and analysis. ## Why Tamanor URL: https://tamanor.com/platform/why-tamanor Tamanor is built safe-by-default: official OAuth only, read-only by default, human approval before any action, row-level tenant isolation, and a full audit trail. ### Safe by design No scraping, no stored passwords, no automatic execution. Tamanor offers an action only when the platform truly supports it and a human has approved it. ### Honest about capability Tamanor advertises only what it can actually do per platform. Where a platform is not yet supported, it says so instead of pretending. Capabilities are read from a single source of truth in the codebase. ### FAQ Q: Is Tamanor fully automated? A: No — automation prepares proposals; a human stays in control of every action. ## Tamanor architecture URL: https://tamanor.com/platform/architecture Tamanor is a multi-tenant application with a Next.js web app, a background worker, PostgreSQL with row-level security, and injectable platform connectors that isolate provider network calls from database transactions. ### Components A Next.js web application serves the dashboard and marketing site. A separate worker process runs scheduled monitoring, token health checks and webhook follow-up. PostgreSQL is the system of record. Platform connectors are injectable: production uses real official-API transports, and tests inject mock transports so the exact production code runs without any network call. ### Read → provider HTTP → write Database work runs in short tenant-scoped transactions. Provider HTTP calls happen strictly between transactions, never inside one, so a slow or failing provider can never hold a database lock or corrupt local state. ### FAQ Q: Does the worker share the web app's database access? A: Both use the same row-level-security runtime role; neither can bypass tenant isolation. ## Tamanor security URL: https://tamanor.com/platform/security Tamanor connects only through official OAuth, never scrapes, never stores passwords, keeps tokens server-side and out of logs, and is read-only by default with human approval before any action. ### Connections Official OAuth and API integrations only. Tamanor never scrapes any platform and never asks for or stores social passwords. Platform capability checks run before any action is offered. ### Tokens OAuth tokens are stored server-side only, encrypted at rest in production. They are never shown in the interface, never written to logs, and never included in the audit trail. ### Isolation & audit Every tenant's data is isolated by PostgreSQL row-level security. Every meaningful action is recorded in an append-only audit log. ### FAQ Q: Do you store my social password? A: Never. Tamanor uses official OAuth; passwords are never requested or stored. Q: Are tokens ever logged? A: No. Tokens are kept out of logs, the UI, error messages and the audit trail. ## Row-level security (RLS) URL: https://tamanor.com/platform/row-level-security Tamanor enforces tenant isolation at the database level with PostgreSQL row-level security, so a forgotten filter in application code can never leak another tenant's data. ### Isolation in the database, not just the app Every tenant-scoped query runs through a non-superuser database role with FORCE ROW LEVEL SECURITY and a tenant-isolation policy. The current tenant is set per transaction; the database itself rejects rows from any other tenant. This is defense in depth: even if application code forgot a tenant filter, the database still returns only the active tenant's rows. ### FAQ Q: What if a query forgets to filter by tenant? A: Row-level security still restricts results to the active tenant — isolation does not depend on application code remembering to filter. ## Audit log URL: https://tamanor.com/platform/audit-log Tamanor records every meaningful action — connections, syncs, proposals, approvals and moderation — in an append-only, tenant-scoped audit log that never contains token material. ### Every action, permanently recorded Connecting an account, running a sync, proposing an action, approving or rejecting it, and executing an approved hide are each written to the audit log with actor, target and metadata. Entries are append-only and scoped to the tenant. Audit metadata is scrubbed of secrets: no token, password or database URL ever appears in an audit entry. ### FAQ Q: Can audit entries be edited or deleted? A: The audit log is append-only; entries are not edited in place. ## Permission model URL: https://tamanor.com/platform/permission-model Tamanor separates platform capability (what an account's OAuth grant truly allows) from workspace roles (what a team member is allowed to do), and offers an action only when both permit it. ### Two layers of permission Platform permission is the truth of what the connected account can do — read comments, hide a comment, read reviews — derived from the OAuth grant and the platform's API. Workspace permission is what a team member's role allows inside Tamanor. An action is only offered when the platform supports it AND the user's role allows it. Missing platform permissions are surfaced honestly as a reconnect/re-grant prompt. ### FAQ Q: What happens if a permission is revoked on the platform? A: Tamanor detects the revoked permission on its next check and surfaces a reconnect prompt instead of failing silently. ## Role model URL: https://tamanor.com/platform/role-model Tamanor uses role-based access within each workspace so owners, admins, analysts, reviewers and viewers see and do only what their role allows. ### Roles fit the job Workspace roles scope who can connect accounts, who can approve moderation actions, and who can only view analytics. Role checks run server-side on every protected action, layered on top of database row-level security. ### FAQ Q: Can a viewer approve a moderation action? A: No. Approval is restricted to roles that permit it; viewers can read but not act. ## Webhook architecture URL: https://tamanor.com/platform/webhook-architecture Tamanor verifies every inbound webhook's signature, routes Facebook and Instagram events through one unified connector, rejects replays, and always resolves the tenant from the connected account — never from the payload. ### Trustworthy by construction Inbound events are verified with an HMAC signature before anything is trusted. A stable dedup key rejects replayed deliveries. Only signature-valid events are ever processed; forged or unsigned events are stored for audit but never acted upon. The tenant is always derived from the matched connected account, never from the webhook body, so a crafted payload cannot cross tenant boundaries. ### FAQ Q: What stops a replayed or forged webhook? A: Signature verification plus a unique dedup key: replays collapse to one event and unsigned events are never processed. ## Worker architecture URL: https://tamanor.com/platform/worker-architecture A separate Tamanor worker runs scheduled read-only monitoring, token-expiry checks and webhook follow-up, each under a trusted tenant context and an account-level lease that prevents overlapping syncs. ### One sync per account, safely The worker acquires a short-lived account-level lease before syncing, so a scheduled run and a manual run can never collide. Reads are idempotent; each item is created once and updated in place on change. The worker only reads. It never executes a moderation action; those flow exclusively through the approval queue. ### FAQ Q: Can two syncs run for the same account at once? A: No. An account-level lease guarantees a single active sync; the second run is skipped cleanly. ## Data protection URL: https://tamanor.com/platform/data-protection Tamanor stores only the OAuth tokens and public content needed to protect a brand, isolates it per tenant with row-level security, keeps secrets out of logs, and cleans up short-lived onboarding data automatically. ### Store less, protect more Tamanor ingests public comments and reviews plus the OAuth tokens required to read them. Tokens are encrypted at rest in production and never exposed. Short-lived onboarding sessions that hold temporary tokens are deleted automatically once they expire. ### FAQ Q: Is data shared between customers? A: No. Row-level security isolates every tenant's data at the database level. ## Privacy URL: https://tamanor.com/platform/privacy Tamanor processes public social content and OAuth tokens for the sole purpose of protecting the connected brand, with tenant isolation, secret scrubbing and no selling of data. ### Purpose-limited processing Content and tokens are processed only to monitor and protect the accounts a customer connects. Tamanor does not sell customer data. See the privacy policy for the authoritative statement. ### FAQ Q: Where is the authoritative privacy statement? A: The privacy policy page is the authoritative source; this page summarizes the technical posture. ## Encryption URL: https://tamanor.com/platform/encryption Tamanor encrypts OAuth tokens at rest in production and blocks storing plaintext tokens in production, so credentials are protected even at the database layer. ### Tokens encrypted at rest In production, OAuth tokens are encrypted before storage and a safety check prevents plaintext tokens from being persisted. Tokens are decrypted only in memory when a read is performed, and are never logged or shown. ### FAQ Q: Are tokens stored in plaintext? A: Not in production — plaintext token storage is blocked and tokens are encrypted at rest. ## AI moderation URL: https://tamanor.com/platform/ai-moderation Tamanor's AI classifies each comment and review for risk and category, combining brand rules with AI analysis, then proposes actions for a human to approve — it never moderates automatically. ### Hybrid classification Every item is scored by a hybrid engine: deterministic brand rules plus AI risk analysis. The result is a risk level, categories and a sentiment, used to prioritize what a human sees first. AI output drives proposals and prioritization only. A human approves any action that touches a platform. ### FAQ Q: Does the AI hide comments by itself? A: No. The AI detects and proposes; hiding a comment requires human approval. ## Automation URL: https://tamanor.com/platform/automation Tamanor automates monitoring, risk detection and action preparation, but keeps execution human-approved: automation creates proposals, it never executes moderation on its own. ### Automate the work, not the decision Scheduled monitoring, deduplicated ingestion, risk scoring and proposal generation are automated. The decision to act stays with a human, so automation never posts, hides or deletes without approval. ### FAQ Q: Can I turn on fully automatic hiding? A: Automatic execution is intentionally not enabled; proposals are prepared for human approval. ## Proposal engine URL: https://tamanor.com/platform/proposal-engine For high-risk items, Tamanor prepares a proposed moderation action with context and routes it to the approval queue; it proposes but never executes automatically. ### From risk to a reviewable proposal When an item is high risk and has no open proposal, Tamanor prepares one. The proposal carries the reason and target so a reviewer can decide quickly. Nothing reaches a platform until the proposal is approved. ### FAQ Q: Do proposals expire or duplicate? A: Tamanor avoids duplicate proposals for the same item and keeps each proposal reviewable in the queue. ## Roadmap URL: https://tamanor.com/platform/roadmap Facebook Page comment monitoring is verified live. Instagram is implementation-complete but verification-pending (Meta App Review). Google Business is a foundation pending approved API access. YouTube, LinkedIn and TikTok are research — not supported. ### What is live, what is pending, what is research Live (verified): Facebook Page read-only comment monitoring, with human-approved hiding off by default. Implementation complete, verification pending: Instagram Professional comment monitoring (read-only) — awaiting Meta App Review before it is live. Foundation, verification pending: Google Business review monitoring — ready for approved API access, not yet live. Research (not supported): YouTube, LinkedIn and TikTok. Tamanor does not claim support until it is real and verified. ### FAQ Q: Does Tamanor support TikTok, YouTube or LinkedIn today? A: Not yet. These are planned; Tamanor states honestly that it does not claim support for them until verified. ## Comment & review monitoring URL: https://tamanor.com/features/comment-monitoring Tamanor continuously reads comments and reviews on connected accounts, deduplicates them, and classifies each for risk so nothing important is missed. ### Never miss a risky comment Tamanor reads new comments and reviews on a schedule and via webhooks, normalizes them into one model, and deduplicates by account and external id so the same item is never counted twice. ### FAQ Q: Which platforms are monitored today? A: Facebook Pages and connected Instagram Professional accounts, plus Google Business reviews as a foundation. ## Reputation analytics URL: https://tamanor.com/features/reputation-analytics Tamanor turns monitored comments and reviews into reputation analytics — risk levels, categories and trends — so a brand can see its exposure at a glance. ### See your exposure Classified items roll up into reputation views by risk level and category, helping teams focus on the highest-impact issues first. ### FAQ Q: Is the analysis based on real content? A: Yes — analytics are computed from the real comments and reviews Tamanor monitors, not sample data. ## Actor risk URL: https://tamanor.com/features/actor-risk Tamanor tracks repeated risky behavior from the same author across a brand's content, so persistent bad actors stand out rather than being judged one comment at a time. ### Judge the pattern, not just one comment By associating risk with authors over time, Tamanor highlights accounts that repeatedly post spam, scams or harassment, giving reviewers context a single comment can't provide. ### FAQ Q: Does Tamanor ban authors automatically? A: No. Actor risk informs reviewers; Tamanor does not ban or take automatic action against authors. ## Action queue URL: https://tamanor.com/features/action-queue The Tamanor action queue holds proposed moderation actions for human review; nothing runs on a platform until a reviewer approves it. ### A single place to decide Proposed actions collect in one queue with the context needed to decide. Approving runs the action (today, Facebook comment hiding); rejecting closes it. Every outcome is audited. ### FAQ Q: What actions can be approved today? A: Controlled Facebook comment hiding. Other platforms are monitored only. ## Approval workflow URL: https://tamanor.com/features/approval-workflow Tamanor's approval workflow keeps a human in control: proposed actions are approved or rejected by an authorized role before anything touches a platform, with every step audited. ### Human control, end to end A proposal is created, reviewed by an authorized role, and only then executed. The full lifecycle — proposed, approved or rejected, executed — is written to the audit log. ### FAQ Q: Who can approve? A: Only workspace roles permitted to approve; role checks run server-side. ## Auto-protection policies URL: https://tamanor.com/features/auto-protection Auto-protection policies let a brand define, per category, when Tamanor should prepare a protective action — still routed through human approval, never auto-executed. ### Policy in, proposals out You set per-category policies for how aggressively Tamanor should react. Policies influence what gets proposed and prioritized; they do not enable automatic execution. ### FAQ Q: Can a policy hide comments automatically? A: No — policies shape proposals; approval stays human. ## Control center URL: https://tamanor.com/features/control-center The Tamanor control center is where a brand configures rules, categories and protection settings that drive monitoring and proposals. ### Configure the firewall Brand rules and protection settings live in one place, so teams can tune what counts as risk and how proposals are prepared. ### FAQ Q: Are rules per brand? A: Yes — rules and policies are scoped to each brand within a workspace. ## Unified inbox URL: https://tamanor.com/features/unified-inbox Tamanor brings comments and reviews from connected accounts into one inbox, so teams triage risk across platforms in a single view. ### One view across accounts Monitored items from every connected account appear in a shared inbox with risk context, so triage isn't scattered across platform tabs. ### FAQ Q: Does the inbox let me reply? A: The inbox is for triage and approval; Tamanor does not post replies on your behalf. ## AI risk detection URL: https://tamanor.com/features/ai-risk-detection Tamanor classifies each comment and review with a hybrid of brand rules and AI analysis, producing a risk level, categories and sentiment used for prioritization and proposals. ### Rules plus AI Deterministic brand rules catch known patterns; AI analysis handles nuance and language. Together they produce the risk signals that drive what a human sees and what gets proposed. ### FAQ Q: Does AI make the final call? A: No — AI informs prioritization and proposals; a human decides. ## Facebook Page integration URL: https://tamanor.com/integrations/facebook Provider status: live_verified (live) Tamanor connects Facebook Pages via official OAuth to monitor comments, detect risk, and hide harmful comments after human approval — the only live moderation action today. ### What Tamanor does with Facebook Tamanor reads Page and post comments, classifies them, and can hide a comment after a human approves it. Hidden-state can be verified. Tamanor never deletes, replies, likes, bans or reports. ### FAQ Q: Can Tamanor hide Facebook comments? A: Yes, after human approval. This is the only live moderation action Tamanor performs today. Q: Does Tamanor delete or reply on Facebook? A: No. Tamanor only hides (after approval) and otherwise monitors. ## Instagram integration URL: https://tamanor.com/integrations/instagram Provider status: implementation_complete_verification_pending (not live) Tamanor's Instagram Professional connector is implementation-complete — discovery through the linked Facebook Page, read-only comment ingestion with pagination and webhooks. Real provider verification via Meta App Review is pending, so it is not yet live. ### What Tamanor does with Instagram The Instagram connector discovers a connected Instagram Professional account through its Facebook Page and reads its comments — media comments and replies, with pagination and near-real-time webhooks. It is read-only: no hide, delete, reply, ban or report. Status: implementation complete, real provider verification pending. Live use requires Meta App Review; until then Tamanor does not present Instagram as live. ### FAQ Q: Is Instagram live today? A: No. The Instagram connector is implementation-complete but not yet live — real provider verification via Meta App Review is pending. Q: Can Tamanor hide Instagram comments? A: No. Instagram is read-only; no moderation action is enabled. Q: How is Instagram connected? A: Through its linked Facebook Page using official OAuth — the two behave as one unified connector. ## Google Business integration URL: https://tamanor.com/integrations/google-business Provider status: foundation_only (not live) Tamanor's Google Business Profile connector is a foundation ready for approved API access — it reads reviewer, rating and text. Real provider verification is pending, so review monitoring is not yet live. ### What Tamanor does with Google Business The Google Business connector reads location reviews (reviewer, star rating, review text) into reputation. It does not reply to reviews automatically. Status: connector implementation/foundation ready for approved API access; real provider verification pending. Review monitoring is not yet live and is not presented as such. ### FAQ Q: Is Google Business review monitoring live? A: No. The connector is a foundation ready for approved API access; real provider verification is pending. Q: Does Tamanor reply to Google reviews? A: No — review replies are not automated. ## YouTube integration (planned) URL: https://tamanor.com/integrations/youtube Provider status: research (not live) A YouTube connector is planned. Tamanor does not yet claim YouTube support; comment monitoring will be enabled only once it is built and verified. ### Planned, not yet claimed YouTube exposes comment threads via its official API. A connector foundation exists in the codebase, but Tamanor does not advertise YouTube support until read sync is implemented and verified. ### FAQ Q: Can I monitor YouTube today? A: Not yet — YouTube is planned and not claimed as supported. ## LinkedIn integration (planned) URL: https://tamanor.com/integrations/linkedin Provider status: research (not live) A LinkedIn Company Page connector is planned. LinkedIn's API access for organic comments is partner-gated, so Tamanor advertises no LinkedIn capabilities until access is verified. ### Honest about restricted access LinkedIn heavily restricts organic comment access. Until that access is granted and verified, Tamanor claims no LinkedIn capability. ### FAQ Q: Does Tamanor support LinkedIn? A: Not yet — it is planned and access is partner-gated. ## TikTok integration (planned) URL: https://tamanor.com/integrations/tiktok Provider status: research (not live) A TikTok connector is planned. Comment read/moderation via the official API is app-review-gated, so Tamanor advertises no TikTok capabilities until it is proven. ### Planned, gated by review TikTok's official comment API is limited and app-review-gated. Tamanor states honestly that TikTok is planned and not yet supported. ### FAQ Q: Does Tamanor support TikTok? A: Not yet — it is planned and app-review-gated. ## Tamanor vs. manual moderation URL: https://tamanor.com/compare/manual-moderation How a centralized, audited, rule-consistent firewall compares with checking each platform by hand. A workflow comparison — no numeric time-savings are claimed. ### What changes Manual moderation means opening each platform and reading comments by hand: coverage depends on who is watching and when, rules live in people's heads, and there is no single record of what was decided. Tamanor centralizes monitored comments and reviews into one place, applies the same brand rules and AI risk detection to every item, and records every action in an append-only audit log — so decisions are consistent and reviewable rather than ad hoc. ### Honest limits Tamanor still keeps a human in the loop: it prepares proposals and a person approves them. It does not claim to eliminate review effort or to guarantee nothing is ever missed — it makes coverage systematic and auditable. No specific percentage of time saved is claimed, because that depends on your volume. ### FAQ Q: Does Tamanor replace human reviewers? A: No. It centralizes and prioritizes the work; a human still approves every action. Q: Do you claim a specific time saving? A: No — any number would depend on your comment volume and team, so we do not publish one. ## Tamanor vs. separate per-platform tools URL: https://tamanor.com/compare/separate-social-tools How a provider-neutral model with shared risk rules and one audit compares with stitching together separate per-platform interfaces. A workflow comparison. ### What changes Using a different interface per platform fragments rules, risk scoring and history across tools. Each tool sees only its own platform, and what an action means differs from one to the next. Tamanor normalizes comments and reviews into one provider-neutral model, applies shared risk and sentiment rules, and keeps one audit — while still respecting each provider's real capabilities (an action a platform cannot perform is never offered). ### FAQ Q: Does one model mean every platform behaves the same? A: No — Tamanor honors each provider's real capability limits; the model is unified, the capabilities are honest per platform. ## Tamanor vs. autonomous AI moderation URL: https://tamanor.com/compare/autonomous-ai-moderation Tamanor is human-in-the-loop, not autonomous: AI detects and proposes, rules and capability gates apply, and a human approves before any action. Execution is fail-closed. ### The real difference A fully autonomous system decides and acts on its own. Tamanor deliberately does not: automatic execution is off. AI produces a risk assessment and a proposed action; brand rules, the approval workflow, platform-capability checks and connector-health gates all apply; and a human approves before anything touches a platform. Execution is fail-closed — if a capability or permission is missing at execute time, the action fails safely and is audited rather than forced through. Tamanor is not, and is not presented as, a fully autonomous moderator. ### FAQ Q: Can I enable fully automatic hiding? A: No. Automatic execution is intentionally not available; proposals are prepared for human approval. Q: Is Tamanor an autonomous AI agent? A: No. It is human-in-the-loop by design; autoExecution is off. ## Tamanor vs. separate Facebook/Instagram/Google interfaces URL: https://tamanor.com/compare/unified-brand-inbox How one normalized inbox for comments and reviews compares with separate provider interfaces — with honest per-provider capability limits and truthful connector states. ### What changes Separate provider interfaces mean switching context between Facebook, Instagram and Google, each with its own view of comments or reviews. Tamanor brings monitored items into one normalized inbox with shared risk context, distinguishing comments from reviews. Availability is honest: each provider shows its real connector state, and only Facebook is live-verified today. Instagram and Google Business appear with their true status (verification pending), never as live. ### FAQ Q: Are all providers live in the inbox? A: No. Facebook is live-verified; Instagram and Google Business are shown with their true verification-pending status. ## Reputation management platform checklist URL: https://tamanor.com/compare/reputation-management-platform-checklist A neutral buyer's checklist for evaluating any reputation/moderation platform, with Tamanor's honest status per item — including what is not yet done. ### How to use this These are provider-neutral criteria to evaluate any platform. Each line states Tamanor's honest status; where something is not yet done, it says so rather than implying completeness. ### Security & data Tenant isolation — yes: PostgreSQL row-level security isolates every tenant at the database layer. Audit — yes: append-only, tenant-scoped audit log without secrets. Token encryption — yes: OAuth tokens encrypted at rest in production; plaintext storage blocked in production. Permission gates — yes: platform capability and workspace role must both permit an action. Data ownership — yes: a customer's data is isolated per tenant and not shared or sold. Key rotation — not yet: token-encryption key rotation remains a roadmap gap. Export / retention controls — not yet: self-service export and retention policies are not implemented. ### Workflow & operations Approval workflow — yes: human approval before any action; fail-closed execution. Provider health — yes: honest connector health/permission states, no fake green. Disconnect lifecycle — yes: disconnecting removes local tokens; provider revoke is best-effort. Workflow persistence — yes: proposals, approvals and outcomes persist and are auditable. Pagination / scalability — yes: read syncs paginate with cursors and are idempotent. Provider verification — partial: Facebook is live-verified; Instagram and Google Business are verification-pending; YouTube/LinkedIn/TikTok are research. ### FAQ Q: Does Tamanor meet every item? A: No — key rotation and export/retention are explicitly not done yet, and several providers are verification-pending. The checklist states each honestly. ## Tenant isolation URL: https://tamanor.com/security/tenant-isolation Tamanor scopes every session and query to one active tenant, layering application permission checks over database row-level security, with system and runtime database access kept separate. ### One active tenant, enforced twice Sessions are tenant-scoped: a request carries exactly one active tenant. Application permission checks decide what a member may do, and PostgreSQL row-level security enforces which rows exist for that tenant at the database layer. Cross-tenant system work (worker discovery, cleanup) uses a separate, narrow access path that is never used on a normal tenant request. The runtime tenant client and the system client are distinct by design. ### FAQ Q: Can one customer see another's data? A: No. Isolation is enforced by row-level security at the database layer, not only by application code. ## Row-level security URL: https://tamanor.com/security/row-level-security Tamanor runs tenant queries through a non-superuser role with FORCE row-level security and a transaction-local tenant context — defense in depth beneath application checks. ### Database-enforced, transaction-local The runtime database role is a non-superuser without the ability to bypass row-level security. FORCE ROW LEVEL SECURITY is on, and the active tenant is set per transaction, so isolation travels with each unit of work. This is defense in depth: even if an application query omitted a tenant filter, the database still returns only the active tenant's rows. ### FAQ Q: What if application code forgets a tenant filter? A: Row-level security still restricts results to the active tenant; isolation does not depend on remembering to filter. ## Authentication & sessions URL: https://tamanor.com/security/authentication Tamanor uses opaque sessions with the token hashed in the database, supporting revocation, expiration and logout invalidation. ### Opaque, revocable sessions A session is an opaque token; the database stores only its hash, never the raw token. Sessions expire, can be revoked, and are invalidated on logout. Server-side checks enforce authentication on every protected route and action. ### FAQ Q: Is the raw session token stored? A: No — only a hash is stored, so the database never holds the usable token. ## Provider tokens URL: https://tamanor.com/security/provider-tokens OAuth provider tokens are encrypted at rest, removed locally on disconnect, and revoked at the provider on a best-effort basis; key rotation is a remaining roadmap gap. ### How tokens are handled OAuth tokens are encrypted at rest in production and never shown, logged or placed in the audit trail. Disconnecting an account removes the stored token locally; revoking at the provider is attempted on a best-effort basis. Honest gap: automated key rotation for token encryption is not yet implemented and remains on the roadmap. ### FAQ Q: Is key rotation implemented? A: Not yet — encryption at rest is in place, but automated key rotation is a remaining roadmap gap. ## Audit logging URL: https://tamanor.com/security/audit-logging Tamanor writes an append-only, tenant-scoped audit log; actor references use a SetNull lifecycle so history survives user removal, and tokens are never logged. ### Append-only, secret-free Meaningful actions are recorded append-only and scoped to the tenant. Actor references use a SetNull lifecycle so removing a user does not erase the historical record. No token, password or connection string ever appears in an audit entry. ### FAQ Q: Do audit entries ever contain tokens? A: No — secrets are scrubbed; the audit log never contains token material. ## Data integrity URL: https://tamanor.com/security/data-integrity Tamanor persists content and reputation atomically, ingests idempotently, uses account-level leases, and enforces referential integrity to prevent orphaned records. ### Consistent by construction Each piece of content and its reputation record are written in one atomic transaction. Ingestion is idempotent, so the same item is never duplicated. An account-level lease prevents overlapping syncs, and referential integrity prevents orphaned records. ### FAQ Q: Can a sync create duplicates? A: No — ingestion is idempotent on a unique key, so re-processing an item deduplicates it. ## Webhook security URL: https://tamanor.com/security/webhook-security Tamanor verifies webhook signatures, deduplicates replays, derives the tenant from the connected account (never the payload), and stores invalid webhooks only for audit — never processing them. ### Trusted by construction Inbound webhooks are signature-verified; only valid events are processed. A stable dedup key rejects replays. The tenant is derived from the matched connected account, never from the payload, so a crafted body cannot cross tenants. Invalid or unsigned events are stored for audit but never processed. ### FAQ Q: Are unsigned webhooks acted on? A: No — they are stored for audit only and never processed. ## Responsible AI URL: https://tamanor.com/security/responsible-ai Tamanor's AI is human-in-the-loop: it detects and proposes under brand rules and provider capability gates, with an approval step and fail-closed execution — never unbounded autonomy. ### AI proposes, humans decide AI produces risk assessments and proposals only. Brand rules, the approval workflow and provider capability gates all apply, and execution is fail-closed. Automatic execution is off; Tamanor is not an unbounded autonomous agent. ### FAQ Q: Does the AI act on its own? A: No — it proposes; a human approves, and execution is capability-gated and fail-closed. ## Security disclosure URL: https://tamanor.com/security/disclosure How to report a security concern to Tamanor. Reports reach the team through the contact channel; a dedicated security address is configurable before production. ### Reporting a concern If you believe you have found a security issue, please reach the team through the contact page. We ask reporters to avoid accessing or modifying other users' data and to give us a reasonable chance to respond before public disclosure. A dedicated security mailbox is configurable before production; until it is announced, the contact channel is the authoritative route. Tamanor does not publish a placeholder address that is not monitored. ### FAQ Q: Where do I report a vulnerability? A: Use the contact page. A dedicated security address is configurable before production and will be announced when live. ## Getting started URL: https://tamanor.com/docs/getting-started Connect a Facebook Page or Instagram Professional account through official OAuth, let Tamanor monitor comments, and approve proposed actions from the queue. ### Three steps 1) Connect an account via official OAuth. 2) Tamanor begins monitoring and classifying comments. 3) Review proposed actions in the approval queue and approve or reject. ### FAQ Q: Do I need a password? A: No — you connect through official OAuth, never a password. ## Connect a Facebook Page URL: https://tamanor.com/docs/connect-facebook Connect a Facebook Page through Meta's official OAuth so Tamanor can monitor comments and, after approval, hide harmful ones. ### Connect via OAuth Start the connection, grant the requested permissions on Meta, and Tamanor stores only the OAuth token (encrypted in production). Tamanor then discovers your Page and begins read-only monitoring. ### FAQ Q: What permissions are needed? A: The Page permissions required to read comments and, for hiding, manage engagement — requested through Meta's OAuth. ## Connect an Instagram account URL: https://tamanor.com/docs/connect-instagram Connect an Instagram Professional account through its linked Facebook Page via official OAuth so Tamanor can monitor its comments (read-only). ### Connected through the Facebook Page Tamanor discovers the Instagram Professional account linked to your Facebook Page during OAuth. The Page and Instagram behave as one unified connector, and Instagram monitoring is read-only. ### FAQ Q: Do I connect Instagram separately? A: No — it is discovered through its linked Facebook Page. ## Roles & permissions URL: https://tamanor.com/docs/roles-and-permissions Understand Tamanor's workspace roles and how platform permission plus role permission together decide what actions are available. ### Two permission layers Platform permission (what the OAuth grant allows) and workspace role (what your role allows) both must permit an action before it is offered. Approvals are limited to authorized roles. ### FAQ Q: Can I limit who approves actions? A: Yes — approval is restricted to roles you grant it to. ## Webhooks URL: https://tamanor.com/docs/webhooks Tamanor verifies webhook signatures, deduplicates deliveries, routes Facebook and Instagram events through one connector, and resolves the tenant from the connected account. ### Signed, deduplicated, tenant-safe Every inbound event is signature-verified; only valid events are processed. A dedup key rejects replays. The tenant is always derived from the matched account, never from the payload. ### FAQ Q: Are unsigned webhooks processed? A: No — they are stored for audit but never processed. ## Security overview URL: https://tamanor.com/docs/security-overview A concise technical overview of Tamanor's security posture: OAuth only, read-only by default, encrypted tokens, row-level tenant isolation, and an append-only audit log. ### The essentials Official OAuth only; no scraping; no passwords. Tokens encrypted at rest and kept out of logs. Row-level security isolates tenants. Every action is audited. Read-only by default with human-approved actions. ### FAQ Q: Where is the full security page? A: The public security page summarizes trust and safety; this doc is the technical companion.