The short version
Subportly is built around a simple architecture with a small attack surface and OAuth-only access to your Reddit accounts. Here is how it works.
Reddit access is OAuth only
This is the part that matters most, and it is structural rather than aspirational.
When you connect a Reddit account, Reddit issues Subportly an OAuth token scoped to the permissions you grant. That means:
- We never see, ask for, or store your Reddit password. OAuth does not expose it to us.
- We can only do what the granted scopes allow: read your messages, modmail, and mentions, and send replies you compose.
- Disconnecting an account revokes our access. You can also revoke Subportly from Reddit’s side at any time in your Reddit app settings, which cuts us off immediately.
- Tokens are stored encrypted and are never written to logs or error reports.
Data protection
- All traffic to and from Subportly is encrypted in transit with TLS.
- Data is stored on managed cloud infrastructure that encrypts data at rest.
- We cache message content so the inbox can display and search your history. Disconnecting an account deletes its cached content promptly.
- We do not sell your data and we do not use your message content to train AI models.
Access and accounts
- Application access is authenticated per user; teammates only see the workspaces they are invited to.
- Production access is limited to the people who build Subportly.
Responsible disclosure
Found a vulnerability? Tell us at subportly.com/contact. We take reports seriously, respond quickly, and credit researchers who want credit. We do not run a paid bounty program.
Questions about any of this: subportly.com/contact.