How Spaces protects your accounts and data

Your social media passwords stay with you

You never type your Instagram, LinkedIn, Messenger, X or email password into Spaces. Those accounts connect through a secure sign-in link, and WhatsApp connects by scanning a QR code, the way you would link WhatsApp to a computer. Spaces does not ask for, or store, the passwords to the accounts you connect.

You can disconnect any account from your dashboard, or from the platform’s own settings, whenever you like. More on how each channel connects is on the account safety page.

A key for each AI agent, with only the access you allow

Every AI agent you connect gets its own key, even when you connect it by signing in rather than pasting a key. On the Your agent page you tick what each agent may do:

• Read messages, chats and accounts. Every key can read, and nothing more unless you allow it.
• Reply and start chats, which is a separate permission.
• Publish posts and comments, separate again.
• Connect and disconnect accounts, separate again.
• Manage your other agents, which is never given by default.

Developers can also create keys by hand: read-only keys, keys that can send, and draft-only keys. A draft-only key’s replies wait as drafts for a person to approve, and the key never sends them itself.

A key is shown once, when it is created. Spaces keeps only a one-way fingerprint of it (a SHA-256 hash) and its first few characters, so you can tell your keys apart, and nobody at Spaces can read the key back. If a key might have leaked, remove it and it stops working at once. You can also pause an agent and resume it later.

Signing in, and two-step sign-in

You sign in to Spaces with your email address and a password. Passwords need at least 10 characters, very common passwords are refused, and Spaces stores only a salted scrypt hash of each password, never the password itself. Sign-in attempts are limited for each network address and each email address, which slows down anyone trying to guess.

For a second step, add an authenticator app such as 1Password, Google Authenticator or Authy under Security in your dashboard settings. After your password, Spaces then asks for the 6-digit code the app shows. The secret behind those codes is encrypted (AES-256-GCM) before it is stored. You also get ten single-use recovery codes, shown once and stored only as hashes, in case you lose your phone. A sign-in that has not finished expires after 10 minutes or 5 wrong codes.

The owner of a workspace can require two-step sign-in for everyone in it. People who have not set it up yet are asked to add an authenticator app the next time they sign in. Passkeys are no longer offered.

Your session lives in a cookie that page scripts cannot read and that is only sent over HTTPS. Spaces stores only a hash of it, and it lasts up to 30 days.

An audit log of changes

Spaces writes an audit record when something important changes in a workspace, including:

• a member being invited, changing role or being removed, and ownership moving to someone else;
• an agent’s access being changed, and an agent being paused, resumed or removed;
• all sending being paused or resumed;
• a link to connect or reconnect an account being requested, and an account being disconnected;
• a chat being handed to a person, or taken back.

The record says who did it, when, and whether it worked, and keeps a fingerprint of the request rather than a copy of it. When the Spaces team suspends a key or a workspace, that goes in the same log. Each agent’s card on the Your agent page shows its last 20 actions.

Limits and an automatic pause on every account

Every connected account has daily limits, pacing between messages and a four-week warm-up when it is new or reconnected. Sending pauses on its own when an account reaches a limit, or when the platform signs it out or asks for a check. You can pause all sending from Settings → Pause everything, or pause one agent. The numbers for each channel are on the limits page.

These protections lower the risk, but each platform makes its own decisions, so no tool can promise an account will never be limited.

Your data, and deleting it

The Spaces website, dashboard, API and MCP server all use HTTPS. The site sends anyone who arrives over plain HTTP to HTTPS, and tells browsers to use HTTPS only from then on.

Spaces keeps a copy of recent chats and messages so your agent can read them. Every message leaves that copy after 90 days, recent events are cleared after 14 days, and disconnecting an account removes its copy at once.

You can ask for your data to be deleted at any time. The data deletion page explains what a request covers and gives you a status page to follow it. Our privacy policy says what we hold and why, and business customers can sign our Data Processing Agreement.

Reporting a security problem

If you think you have found a security problem in Spaces, or that someone else is using your account, email hello@spacesos.com. Tell us what you saw and when. Please never send passwords, API keys or recovery codes by email. If a key may be exposed, remove it in your dashboard first.

Does Spaces store my Instagram, LinkedIn or WhatsApp password?

No. You sign in to each platform through a secure link, or scan a QR code for WhatsApp. Spaces never asks for those passwords, and you can disconnect an account at any time.

How does Spaces store API keys?

Each key is shown once, when you create it. Spaces keeps only a one-way hash of the key and its first few characters, so the key cannot be read back from our database.

Does Spaces have two-step sign-in?

Yes. You can add an authenticator app, which asks for a 6-digit code after your password, and you get ten single-use recovery codes. A workspace owner can require it for everyone.

How do I stop an AI agent straight away?

Pause or remove it on the Your agent page, and it stops at once. To stop every agent, use Settings → Pause everything.

How do I get my data deleted?

Follow the steps on the data deletion page, or email hello@spacesos.com from the address on your account. You get a code to follow the request on a status page.

Is there a Data Processing Agreement?

Yes. Read it on the DPA page and email hello@spacesos.com for a signed copy.