Security at PQZ

Sign in with email and password, a magic link, or your Google or Microsoft account. Turn on two-factor authentication with an authenticator app in Settings › Security, with recovery codes for when you lose your phone.

Owners, Approvers, Editors and Viewers each see and do only what their role allows. Agency adds custom roles with a permissions matrix, for example who may connect channels, invite people or change billing.

You sign in to each social channel on its own page. PQZ stores the resulting access token encrypted and never shows it in the app. PQZ asks only for the permissions it needs to publish, read insights and manage comments or reviews. Disconnect any account at any time.

API keys are server-side only, can be read only or read and write, and can be revoked immediately; anything using a revoked key stops working at once. Webhooks post JSON for post.published, post.failed and post.approved and retry failed deliveries five times.

Approvals, publishes, invitations, API key changes and security changes are recorded with who and when. If PQZ staff ever need to open your workspace to help with a support request, a reason is required, the action is written to your audit log and a banner tells you an operator is in.

Email [email protected] with details. We will confirm receipt and keep you updated while we investigate.