Authentication
Password hashing, per-account lockout after repeated failures, optional TOTP two-factor with single-use backup codes, email verification, and Google/Apple sign-in.
Vendor security pack
What is implemented, who else touches your data, how long we keep it, and what does not exist yet. No certification is claimed anywhere on this page.
Implemented controls
Authorization and tenancy
Every client, report and job is scoped to an organization and re-checked at the page and API boundary. Roles separate members, organization admins and platform superadmins.
API access
Named API keys that can be revoked individually, per-key usage logging and rate limits. Keys are stored hashed; the raw value is shown once.
Audit trail
Administrative and subscription actions are recorded with actor, target and timestamp, and can be exported for your own review.
Public report links
Share links use random tokens, can carry a password, and can be given an expiry date; revoking a link takes effect immediately.
Transport and session
HTTPS with HSTS, secure and same-site session cookies, and CSRF protection on state-changing requests.
Secrets
Provider credentials live in server-side configuration, never in the browser, and are redacted from logs and error reports.
Subprocessors
Third parties this installation is configured to send data to. The list is generated from the live configuration, not maintained by hand, so a provider nobody enabled is never listed.
| Vendor | Purpose | Data shared |
|---|---|---|
| Serper | Google SERP results | Search queries, language and region |
| Google (Search Console & Analytics) | Read-only import of your own search and analytics data | OAuth tokens, property identifiers |
| Your SMTP provider | Transactional and report email | Recipient addresses and report contents |
Data retention
Local database backups
Kept 14 days, then deleted by the scheduled prune job.
Customer project data
Kept while the subscription is active or paused. Deleting a client removes its keywords, checks, reports and generated content across every related table in one transaction.
Evidence stored with measurements
SERP screenshots and verbatim AI answers are kept alongside the check they belong to, so any number in a report can be traced to its source, and are removed with it.
Roadmap — and what does not exist yet
Named plainly, because a review that discovers a gap later is a lost deal, and a discovered omission is worse than a stated one.
| Item | Status | What that means today |
|---|---|---|
| SSO / SAML | planned | Single sign-on against your identity provider. Not available today; accounts are created per user with optional two-factor. |
| SCIM provisioning | planned | Automated user provisioning and de-provisioning. Not available today; members are managed in the organization settings. |
| SOC 2 Type II | not started | No audit has been performed and none is claimed. The controls above are implemented and documented; an external audit is a funding decision, not a technical blocker. |
| Contractual SLA | on request | Uptime and support commitments are agreed per contract rather than published as a blanket promise. |
| Data residency choice | not available | Data is stored on the platform's own infrastructure in one region. Region selection is not offered today. |
Need a DPA or your questionnaire answered?
Send the document and we answer it against this page. Do not include credentials or customer data in the form.
Request security documentation