Safe by default. Official by design.
Boomly runs on the official Meta & Google platforms, encrypts your tokens at rest, and never touches your passwords. Here’s exactly how your account — and your customers’ trust — stays protected at every layer.
Official Meta Tech Provider — 100% Safe & Compliant
YouTubeOfficial Google API v3Built using official Meta & Google APIs to keep your accounts protected and fully compliant — no risk of shadowbans or restrictions.
Verified, dated credentials
Not marketing badges — real platform reviews we passed, with the dates to match.
Meta App Review
Approved for live-mode Instagram messaging & comment permissions after full Meta App Review.
Approved · May 2026Meta Tech Provider
Verified by Meta as an approved Technology Provider — cleared to build on businesses’ Meta assets.
Verified · May 2026Google OAuth Verification
YouTube Data API v3 access verified by Google — the “unverified app” consent warning is gone.
Verified · July 2026Encryption & access, done right
Every control below is live in the product — not a roadmap promise.
AES-256-GCM token encryption
Your connected-account access & refresh tokens are encrypted at rest with AES-256-GCM — a unique IV and auth tag per value. In production we never write a plaintext token to the database.
Encrypted in transit (TLS)
Every request runs over HTTPS/TLS. Neither your data nor your customers’ conversations ever travel the network in the clear.
Passwords hashed with bcrypt
Account passwords are salted and hashed with bcrypt (cost 12) and compared in constant time. We can never see, log, or recover your raw password.
Official OAuth — no passwords shared
You connect through Meta & Google’s official OAuth. We never ask for or store your social passwords, and you can disconnect and revoke access at any time.
Rate limiting & abuse protection
Login, sign-up and OTP endpoints are rate-limited to shut down credential-stuffing and brute-force attempts before they start.
Official platform APIs only
Built entirely on Meta & Google’s official APIs — no scraping, no bots, no browser extensions. That’s what keeps your account free of shadowban or ban risk.
You stay in control
It’s your account and your data. Connect on your terms, and leave whenever you want.
Disconnect anytime
Revoke Boomly’s access to any connected account in one click — the stored tokens are deleted immediately.
Manage connectionsDelete your data
Request full deletion of your account and associated data whenever you choose.
Data deletionPrivacy policy
Read exactly what we collect, why, and how long we keep it — in plain language.
Read privacy policyFound a vulnerability? Responsible disclosures are always welcome — reach us via the contact page.
Ready to put replies on autopilot?
Set up your first comment-to-DM automation in under 5 minutes. Capture leads from every reel, story and post — without lifting a finger.