Security

How we handle your data

When an agency puts a client’s data in our product, they are extending their own promise to that client. This page describes what we actually do, in enough detail to be checked — and ends with what we do not claim, because that is the part most vendors leave out.

Credentials

Passwords are hashed with bcrypt before storage. We never store, log or email a plaintext password.
Temporary passwords issued during onboarding are shown exactly once, to the admin who created the account. They are not retrievable afterwards — only replaceable.
Suspending an agency blocks every one of its members at login, not just in the interface.

Access scoping

Which websites a person can see is decided by a single authorization function, used by the dashboard, the API and the reporting queries alike. A second, unguarded path is exactly the kind of gap that leaks one client's data into another's report, so there is not one.
Team members can be scoped to a single client and see nothing outside it.
Agency partners are scoped to one agency and are explicitly denied access to client website data — a revenue share does not come with a view of the work.

Tokens and links

Client portal, audit and invoice links use 192 bits of cryptographically random entropy. They are unguessable, and an agency can rotate any of them, which immediately invalidates the old link.
API tokens are stored only as SHA-256 hashes with a short display prefix. We cannot show you a token again after it is issued, and a stolen database does not yield working tokens.
The free-tool email gate is an HMAC-signed, HttpOnly cookie verified on the server. It cannot be bypassed by editing local storage or crafting a request body.

Your clients' data is not our marketing

Client portals, pitch audits and invoices are disallowed in robots.txt for every crawler — including GPTBot, ClaudeBot, PerplexityBot and Google-Extended — and are additionally marked no-index at the page level.
On an agency's white-label host, our marketing site, our login and our dashboard are unreachable. The only thing served there is the portal.
We do not publish client results as case studies without asking first.

Accountability

Password resets, role changes, suspensions, agency creation and limit changes are written to an append-only audit log with who did it and when.
Credential-shaped values are stripped centrally before anything reaches that log, so a careless call site cannot leak a secret into the trail.

Transport and infrastructure

The site is served over HTTPS with HSTS, a content security policy and frame-ancestor restrictions.
Database connections require TLS. The database is managed Postgres hosted on Neon.
Public endpoints are rate limited by IP. Outbound fetches are checked against a guard that refuses private and loopback addresses, so a submitted URL cannot be used to reach internal services.

What we do not claim

We are not SOC 2, ISO 27001 or HIPAA certified. No audit is in progress, and we will say so here when one is.
We have not commissioned a third-party penetration test, and we do not run a paid bug bounty.
We do not offer a contractual uptime SLA during the pilot.
We use third-party providers to run scans and send email. Prompts and the domains you track are processed by those providers in order to return results.

If your client’s procurement process needs any of the above, tell us what is required and we will give you a straight answer about whether and when we can meet it.

Reporting a vulnerability

Write to us through the contact form with enough detail to reproduce the issue. We will acknowledge it and tell you what we intend to do. Please do not test against other agencies’ workspaces or against client portals — those contain data belonging to people who did not consent to your testing.

See also our privacy policy and terms of service.