Practices
Tenant isolation
Every customer record is scoped to a company and protected by row-level security policies in the database, so one account's audits, reports, prompts, and connections are not readable by another. Cross-tenant isolation is re-verified by an automated QA suite that attempts foreign-company reads and writes on each release.
Authentication and access
Accounts are authenticated through managed email and Google sign-in. Administrative capability is granted by roles stored in a dedicated roles table and checked server-side; it is never inferred from browser storage. Administrative impersonation of a customer account is audit-logged.
Secrets and credentials
Third-party credentials — publishing tokens, Search Console access, AI provider keys — are held as server-side secrets and used only inside backend functions. They are never shipped to the browser, and access tokens you paste are not displayed back to you afterwards.
Encryption
The application is served over HTTPS, and traffic to the database, storage, and third-party APIs travels over TLS. Data at rest is stored in managed cloud infrastructure that encrypts stored data.
Publishing safety
Nothing reaches your website until you approve it. Publishing runs through a reviewable change set, records each run, and supports rollback. For Git-hosted sites the change arrives as a commit or pull request you can inspect and revert.
Backups and deletion
Customer data is backed up nightly, and restore procedures are exercised on a recurring drill. Deleted records are soft-deleted for thirty days and then permanently purged. Account deletion is available in-product and removes your account data on the same schedule.
Monitoring
Synthetic probes and automated regression checks run continuously against production and page the team on failure. Current platform state is published on the status page.
Enterprise identity (SAML SSO)
Enterprise accounts can sign in through their own identity provider — Okta, Entra ID, OneLogin, or Google Workspace SAML. Sign-in is routed by email domain at /auth/sso: we enroll the domains you name, you send us your IdP metadata URL, and we configure and test the connection with you. Administrative capability is still granted by server-side roles after sign-in — an SSO assertion never confers admin rights on its own.
SOC 2 readiness
We maintain a readiness pack for security review rather than a certificate we do not hold. It contains our written control descriptions mapped to the SOC 2 Trust Services criteria, evidence from the automated cross-tenant isolation tests that run on each release, our subprocessor list, data retention and deletion schedules, and the records of our recurring backup-restore drills. Enterprise customers can request it during procurement, and we will complete standard security questionnaires against it.
To be explicit: readiness is not an audit. No SOC 2 Type I or Type II report exists for AgenticSEO today, and we will not describe our controls as audited or certified until one does.
What we do not claim
AgenticSEO is early-stage software from a small team. We hold no completed third-party security audit or certification, and we will not imply one. If your procurement process requires a specific attestation, tell us what it is before you buy and we will tell you honestly whether we can meet it.
Reporting a vulnerability
Email info@tractiongappartners.com with steps to reproduce. Please do not test against other customers' data or run denial-of-service traffic. We will acknowledge your report and keep you updated until it is closed.
Related
- Privacy policy — what we collect and why.