API Security & Compliance Architecture
Official Technical Architecture & Data Safety Guidelines for tool.zumpey.com
1. Architecture Overview
Zumpey Scheduler is built from the ground up to comply with Pinterest Developer Terms of Service and API v5 best practices. The platform does not use unofficial scraping, browser automation, or simulated user logins. All actions are authenticated through Pinterest OAuth 2.0 and dispatched exclusively through official HTTPS endpoints (https://api.pinterest.com/v5/).
2. OAuth 2.0 Least-Privilege Scopes Matrix
We request only the minimum set of permissions necessary to deliver the scheduling and analytics service:
| Scope | Usage Description | Necessity |
|---|---|---|
| pins:read | Read published pin metadata and performance metrics. | Required |
| pins:write | Publish user-approved pins to target boards at scheduled time slots. | Required |
| boards:read | Fetch the authenticated user's boards directory to allow destination selection. | Required |
| boards:write | Optional creation of user-organized campaign boards inside the app. | Standard |
| user_accounts:read | Fetch public profile information (username, avatar) for account management. | Required |
3. AES-256-GCM Token Encryption
Access and Refresh Tokens received from Pinterest OAuth exchanges are encrypted before writing to our PostgreSQL database using authenticated AES-256-GCM encryption with unique initialization vectors (IV) and authentication tags.
plaintext_token → AES-256-GCM(Key, IV, plaintext) → { iv, authTag, ciphertext } → Encrypted PostgreSQL Storage
4. Rate Pacing & Spam Prevention Engine
To safeguard user accounts and prevent network abuse, Zumpey Scheduler implements multi-layered rate limiting and anti-spam guardrails:
- 7-Day URL Spacing: The system automatically blocks duplicate destination URLs from being scheduled to the same board within 7 days.
- Global API Rate Throttling: API requests are throttled with a maximum concurrency limit per account, ensuring API usage remains well below Pinterest's global tier limits.
- Board Rotation Staggering: Pins assigned to multiple boards are distributed across minimum 3-day intervals rather than simultaneously blasted.
- Proactive Token Refresh: Expiring tokens are silently refreshed 60 minutes prior to expiration using secure refresh tokens to prevent interrupted service.
5. 1-Click Revocation & Immediate Data Purging
Users maintain complete autonomy. Disconnecting an account immediately purges all encrypted tokens, synced board caches, and queued pins permanently from our database.