Trust & Security
This page is maintained by GenPressa to answer common security and privacy questions about the platform. It describes controls that are in place today — it is not a certification, an audit, or an independent verification.
Security is a shared responsibility: GenPressa operates the application and the controls described below; our hosting provider operates the underlying infrastructure; and you remain responsible for keeping your own account credentials, WordPress connections, and API keys safe.
Access & authentication
Accounts are protected by email + password sign-in and optional Google single sign-on. Sessions are managed by our auth provider with short-lived access tokens and rotating refresh tokens.
Administrative access inside GenPressa is granted through a dedicated admin role table, not by hardcoded credentials. Privileged operations are checked server-side.
Data isolation
Every record in the database is owned by a specific user and scoped to a specific connected site. Row-level security policies in the database enforce that users can only read and modify their own data — settings, rules, posts, feeds, and credentials cannot leak across user accounts or across a user's own sites.
Secrets such as WordPress application passwords are stored server-side and accessed only by trusted edge functions; they are never returned to the browser.
Encryption in transit
Traffic to genpressa.com and to all backend APIs is served over HTTPS. Connections to your WordPress site from our publishing workers are made over HTTPS whenever your site supports it.
Subprocessors & integrations
GenPressa relies on a small set of providers to operate the service, including our managed backend and database provider, AI model providers used to generate article drafts and images, Stripe for billing, Resend for transactional email, and the WordPress sites you choose to connect. Each provider only receives the data needed to perform its task.
Retention & deletion
You can disconnect any WordPress site or delete your account from the dashboard at any time. On account deletion we remove your stored credentials, automation rules, generated drafts, and account-level settings. Articles you have already published to your own WordPress site remain on your site under your control.
Reporting a security issue
If you believe you've found a security vulnerability, please email contact@genpressa.com with steps to reproduce. Please give us a reasonable window to investigate and remediate before any public disclosure.
See also our Privacy Policy and Terms of Service.