Security and trust
You hand Mastak your Instagram inbox. Here is what protects it today, written so you can check every line with us.
What's in place
Only measures that run now. When something new goes in, it gets added here.
- Hosted in the US
- Mastak's servers are in the United States.
- Locked server access
- Signing in to the servers takes an SSH key; passwords don't work there. A firewall is on in front of them.
- Tested, then fixed
- In August 2026 we ran automated security testing against the app. It found real problems in the Instagram login flow (OAuth), in a server request path that could be pointed at other addresses (SSRF) and in the browser's Content Security Policy (CSP). All three are fixed.
- Instagram's official API
- Mastak connects through Instagram's own login and messaging API. You can remove its access from your Instagram account whenever you like.
Your buyers' messages
Data that comes to Mastak from Instagram is used only to reply to the buyers who write to your business and to show you those chats. We don't sell it.
The exact policy wording comes from our lawyer and will be in the privacy policy. To have your data deleted, see data deletion.
Found a hole? Tell us first
Write to [email protected]
A person who works on Mastak reads every report. It helps to include:
- what you found and where (the page or the request)
- the steps that show it
- what someone could do with it
Please give us a chance to fix it before you share it anywhere, and don't touch other people's data while testing. We don't run a paid bounty program.