Security, described plainly
Every control below exists in the product today. We describe what we run and what we do not, including what we are not certified for.
Tenancy & access
- Every row of customer data is isolated by PostgreSQL row-level security keyed on workspace membership: removing a member revokes their access at the database, not the UI.
- Roles (owner / admin / member / viewer) are enforced server-side; billing and deletion are owner-only.
- Single sign-on (SAML/OIDC via your identity provider) is available on the Agency plan, with a per-workspace login-domain binding and an owner-controlled password fallback.
Encryption & secrets
- Data is encrypted in transit (TLS) and at rest by the managed Postgres/Storage layer.
- Connector credentials (Google Analytics, Search Console, Cloudflare) are encrypted with AES-256-GCM before they touch the database; the key never leaves the server.
- Personal API keys are stored only as SHA-256 hashes (shown once at creation).
Auditability
- An immutable audit ledger records every mutating action (configuration, membership, billing state) and survives workspace deletion so disputes can be defended.
- Background jobs are signature-verified; cron endpoints require bearer secrets.
Your data, your call
- Self-serve GDPR export and deletion with a cancellation window.
- Retention windows per plan (7 days to 2 years), published on the pricing page: that is how long scan history stays readable in the dashboard.
- Chargeback retention holds defer purges when a dispute is open.
What we are not
We do not hold SOC 2 Type II certification, ISO 27001 certification, or HIPAA compliance, and this page deliberately does not borrow the shape of a compliance badge. Enterprise customers who need evidence beyond this page can contact us and we will answer specifically, including about the controls listed above.
Found something wrong? Tell us. We treat security reports as priority mail.