Meta Platform Data Flow Diagram

Platform Data Architecture — AI Bizlutions

Last Updated: May 7, 2026

---

1. Overview

AI Bizlutions is a SaaS CRM and social marketing platform (Tech Provider) that manages Meta Platform integrations on behalf of customers. Each customer connects their own Facebook Page and/or Instagram Professional account via OAuth. Platform Data is processed only at the customer's direction and stored with strict tenant isolation.

---

2. Data Collection Points

Source	API Endpoint	Data Collected
Facebook Login	Graph API /oauth/access_token	User access token, user ID
Facebook Pages	Graph API /me/accounts	Page ID, page name, page access token, category
Instagram Business	Graph API /me?fields=instagram_business_account	Instagram user ID, username
Facebook Profile	Graph API /me?fields=id,name,email	Meta user ID, display name, email

---

3. Data Flow Architecture

User Browser (React SPA)
    |
    | HTTPS (TLS 1.2+)
    v
AWS API Gateway (us-east-2)
    |
    | Internal AWS network
    v
AWS Lambda Functions (Node.js 20.x)
    |
    |--- integrations.ts: OAuth token exchange, credential storage
    |--- socialPostingService.ts: Graph API publish calls
    |--- facebookTokenService.ts: Token refresh
    |--- gdpr-delete.ts: Cascade deletion + token revocation
    |
    |--- [Outbound HTTPS] --> graph.facebook.com (Graph API v23.0)
    |
    v
AWS DynamoDB (us-east-2, encryption at rest via AWS-managed keys)
    |
    |--- credentials table: Stores encrypted OAuth tokens
    |      (AES-256-GCM via TOKEN_ENCRYPTION_KEY)
    |      Partition: credentialId (one per customer)
    |
    |--- social table: Stores post content + metadata
    |      Partition: customerId (tenant-isolated)
    |
    |--- activity-logs table: Audit trail (90-day TTL)
    |      Partition: customerId + timestamp SK
    |
AWS S3 (us-east-2, SSE-S3 encryption at rest)
    |--- {customerId}/... — Media uploads (tenant-isolated by key prefix)

---

4. Token Protection

• Facebook/Instagram access tokens are encrypted at rest using AES-256-GCM before DynamoDB storage
• Encryption key (TOKEN_ENCRYPTION_KEY) is stored as a Lambda environment variable, never in source code
• Facebook App Secret (FACEBOOK_APP_SECRET) is Lambda env-var scoped, never exposed to frontend bundles
• Tokens are never written to log files in cleartext — CloudWatch PII masking strips sensitive fields
• App authentication is server-side only — app secret never transmitted to client devices

---

5. Tenant Isolation

• Every DynamoDB table uses customerId as the partition key
• S3 objects are prefixed with {customerId}/ — cross-tenant access prevented by key prefix validation
• Each customer's Meta credentials are stored in a separate DynamoDB item
• Multi-tenant agency mode maintains logical separation via customer-scoped queries

---

6. Data Deletion Flow

When a user requests account deletion (DELETE /api/auth/account):

1. Revoke Facebook permissions via Graph API DELETE /me/permissions
2. Revoke Instagram permissions via Graph API DELETE /me/permissions
3. Delete encrypted credentials from DynamoDB
4. Delete all social posts from DynamoDB
5. Delete all S3 objects under {customerId}/
6. Delete customer record (last)
7. Write tamper-resistant audit receipt with masked PII

Meta data deletion callback (POST /api/integrations/facebook/deauthorize):

• Processes Meta-initiated deauthorization webhooks
• Removes Facebook/Instagram credentials from DynamoDB
• Returns confirmation code per Meta callback protocol

---

7. Service Providers with Platform Data Access

Provider	Purpose	Data Shared	Agreement
Amazon Web Services (AWS)	Cloud hosting, compute, storage, database	All Platform Data (encrypted at rest)	AWS Service Terms + DPA
Google (Gemini AI)	AI text/image generation	Sanitized prompts only (PII redacted before transmission)	Google Cloud ToS

No Platform Data is sold, licensed, or shared with any party beyond the above service providers.

---

8. Data Retention

• OAuth tokens: Retained while integration is active; deleted on disconnect or account deletion
• Social post metadata: Retained while customer account is active
• Audit logs: 90-day TTL (auto-deleted via DynamoDB TTL)
• All Platform Data: Deleted immediately on user request (well within 120-day Meta requirement)