What it is

A tool that holds your rankings, your keyword research and your client list is a tool that needs to be honest about how it protects them. This page describes exactly what the platform does, with no marketing gloss.

How it works

Credentials

API keys are stored hashed, never in plaintext. The plaintext is shown exactly once at creation. A database leak yields no usable credentials.
Passwords use PBKDF2-HMAC-SHA256 with 260,000 iterations and a per-password salt. The iteration count is stored in the hash, so it can be raised later without invalidating existing logins.
Sessions are HttpOnly cookies, with a secure flag for HTTPS deployments.

Tenant isolation

Every data route requires an authenticated principal and is scoped to an organisation. Cross-tenant access returns a plain 404 rather than a 403, so one tenant cannot even confirm that another tenant's id exists. Isolation is covered by tests that probe every project route as a second organisation.

Network behaviour

No third-party telemetry. Nothing about your usage is sent anywhere.
Outbound requests only where configured. The crawler fetches the sites you point it at. Provider APIs are called only when you have supplied keys.
CORS refuses to combine a wildcard allowlist with credentials, because that combination would let any site make authenticated cross-origin calls with the session cookie.

Self-hosting is the strongest privacy control here — and it is not available yet. However good the access control is, the most convincing guarantee is that the data is on your own server and the vendor has no route to it. That is a property of a deployment we intend to offer, not of the hosted service you are using today. On this hosted instance your data is isolated per organisation but does reside with the operator. We would rather say that plainly than let a privacy page imply otherwise.

What it does for your site

It lets you answer a security questionnaire without hand-waving. If you are an agency holding client data, or a company whose SEO strategy is sensitive, those questions arrive eventually — and "here is the authentication model, and how projects are isolated from one another" is a strong answer.

Where the results go

data providers for what leaves this instance when provider keys are configured.

Security and privacy