Security, hosting & privacy

• User accounts: email, hashed password (bcrypt cost 12), MFA secret (encrypted), session refresh hashes
• Organizations: name, slug, branding (logos hosted in DO Spaces)
• Subscriptions: Stripe customer + subscription IDs (no card data; Stripe holds it)
• Crawl artefacts: fetched HTML bodies, parsed JSON-LD, screenshots (Playwright only)
• Issues + recommendations: generated audit findings
• Integration tokens: GSC + GA4 refresh tokens (AES-256-GCM encrypted)
• Audit logs: every admin + sensitive-mutation action, retained 1 year

• In transit: TLS 1.3 everywhere (Cloudflare → Caddy → app)
• At rest: PostgreSQL volume encryption + per-secret application-layer encryption for tokens, integration creds, staging passwords
• Database backups: encrypted snapshots, retained 7 days
• Spaces objects: server-side encryption (SSE-S3 equivalent)

• RBAC: OWNER / ADMIN / EDITOR / VIEWER per organization
• MFA: TOTP, enforced per-org (Agency+) or optional individually
• SSO: SAML 2.0 + OIDC on Enterprise
• Audit logs: every privileged action records actor, IP, user-agent, target, metadata

EU/UK/Swiss data subjects:

• Right to access: download a full export of everything we hold about your account from /me/export. Async job, ZIP delivered to your email
• Right to rectification: update profile, org settings, billing contact in-app
• Right to erasure: /me/delete-account schedules a 14-day grace deletion. Cancel within the window or wait for purge.
• Right to portability: exports are JSON for app data + CSV for tabular reports

DPA available on request: [email protected]. See /legal/dpa for the standard text we incorporate into Terms for EU customers.

Current sub-processors that handle customer data:

• DigitalOcean: hosting + Spaces object storage
• Stripe: payments
• OpenAI / Anthropic: AI enrichment (your plan choice)
• Postmark: transactional email
• Sentry: error tracking (no customer data; just stack traces)
• GitHub: source code only

We maintain a versioned list at /legal/subprocessors. We notify customers 30 days before adding any new sub-processor.

Email [email protected]. We acknowledge within 24h. Bug bounty: out of scope for now (we're pre-Series-A); we'll publicly credit the reporter on /legal/security for any genuine finding.