Security and privacy.
Complete transparency about how we protect your site, credentials, and business data. Security runs through everything we build.
In Transit
- TLS 1.2+ for all connections
- HTTPS enforced on all endpoints
- No HTTP fallback
- Certificate pinning on extension and mobile APIs
At Rest
- AES-256 encryption for CMS credentials
- Database encryption (AWS KMS)
- Separate encryption key per customer
- Regular key rotation
Access controls.
Multiple layers of authentication and authorization protect against unauthorized access. Every request is verified, every token short-lived.
Clerk Authentication
Email, Google OAuth, and magic link authentication via Clerk. Two-factor authentication available.
CMS Credentials
Connects via WordPress REST API using Application Passwords. No admin passwords required — ever.
API Authorization
Every API endpoint verifies the authenticated user owns the requested site. Cross-user access returns 403.
Snapshot and rollback.
Before any modification to your site, a complete snapshot of the current state is created and stored. This includes all field values, not just the changed field.
Click “Undo” within 24 hours of any change to restore previous values instantly. After 24 hours, snapshots are retained for 30 days for audit purposes.
Cross-site insights and anonymization.
We track outcomes across all customers to improve recommendations over time. This data is entirely anonymized and aggregated. No individual site data is ever exposed.
- Which recommendation type worked best
- For which industry and business size
- Starting SEO score range
- Time to ranking improvement
- Content performance metrics
- Backlink quality outcomes
- Page content or text
- Customer names or emails
- Site URLs or domain names
- Financial data or credentials
You can opt out of the cross-client learning system in settings. This disables outcome sharing but does not affect your recommendations or site-specific tracking.
Standards and certifications.
Audited by third parties on the schedules that matter. Documents and DPAs available on request.
Full GDPR compliance. Data processing agreements in place. Right to erasure implemented. DPIA available upon request.
California Consumer Privacy Act compliant. Privacy notice available. Data access and deletion requests processed within 30 days.
SOC 2 Type II certification. Annual third-party audit. Access controls, change management, and data security verified.
We’re transparent about security.
Security details aren’t hidden. Ask us anything about our practices, infrastructure, or certifications — we’ll answer plainly and on the record.
Your data is your business.
We never sell it, share it, or use it for anything beyond improving your SEO.