Security at BravoDM

Connecting Instagram

Connecting an Instagram account runs on Meta's official API and its OAuth flow: the creator signs in on Instagram's own pages and approves the connection there. BravoDM never sees, asks for, or stores an Instagram password.

What BravoDM stores is the access token Meta issues for the connection, encrypted in storage. A creator can disconnect Instagram from inside BravoDM at any time, and disconnecting ends the connection and removes the stored token.

DM automation, on Meta's rules

Comment-to-DM automation runs only on the official API, inside its rules: a person acts first by commenting, replies stay inside Instagram's 24-hour messaging window, and a comment earns at most one private reply. No password bots, no cold outreach, no broadcasts.

Your data

What BravoDM collects, why, and how long it is kept is set out in the privacy policy. Deleting an account and its data follows the steps on the data deletion page, and the deletion path works whether or not the creator can still sign in.

How the service is protected

Every page and API call travels over HTTPS, so traffic between a creator and BravoDM is encrypted in transit. Public endpoints are rate limited, so a flood of requests gets turned away instead of taking the service down. The service's security is reviewed every week, and what the review finds gets fixed or reported to the founder for a decision.

Report a security issue

Found something that looks wrong? Email support@bravodm.com with what you saw. The same contact is published in BravoDM's security.txt.