Security

Tenant isolation

Every customer record is scoped to a company and protected by row-level security policies in the database, so one account's audits, reports, prompts, and connections are not readable by another. Cross-tenant isolation is re-verified by an automated QA suite that attempts foreign-company reads and writes on each release.

Authentication and access

Accounts are authenticated through managed email and Google sign-in. Administrative capability is granted by roles stored in a dedicated roles table and checked server-side; it is never inferred from browser storage. Administrative impersonation of a customer account is audit-logged.

Secrets and credentials

Third-party credentials — publishing tokens, Search Console access, AI provider keys — are held as server-side secrets and used only inside backend functions. They are never shipped to the browser, and access tokens you paste are not displayed back to you afterwards.

Encryption

The application is served over HTTPS, and traffic to the database, storage, and third-party APIs travels over TLS. Data at rest is stored in managed cloud infrastructure that encrypts stored data.

Publishing safety

Nothing reaches your website until you approve it. Publishing runs through a reviewable change set, records each run, and supports rollback. For Git-hosted sites the change arrives as a commit or pull request you can inspect and revert.

Backups and deletion

Customer data is backed up nightly, and restore procedures are exercised on a recurring drill. Deleted records are soft-deleted for thirty days and then permanently purged. Account deletion is available in-product and removes your account data on the same schedule.

Monitoring

Synthetic probes and automated regression checks run continuously against production and page the team on failure. Current platform state is published on the status page.