Security, by default.
What we do to keep your workspace private, exactly what we send to which provider, and how to reach us about a vulnerability.
01 · You
Browser & team
- HTTPS with HSTS
- Strict content security policy
- One-time email sign-in links
02 · App
Mentioned
- Server-side jobs, time-boxed
- Secrets in env vars & Vault
- Roles checked on every action
03 · Data
Database
- Row-level security on every table
- Encrypted at rest
- Policies covered by tests
AI engines
Your buyer prompts
Anthropic
Answer text, brand & competitor names
Stripe
Billing — card data never touches us
Resend
Email address, to send email
Row-level security everywhere
Every table enforces access in the database itself, not just in the app. Policies are covered by automated tests.
No passwords
Sign-in uses one-time email links, so there’s no password to reuse, phish or leak.
Secrets stored as hashes
API keys, invitation tokens and share links are stored only as SHA-256 hashes and shown once.
Strict browser security
A content security policy with no third-party scripts, no framing and HTTPS enforced.
Signed, guarded webhooks
Every delivery is HMAC-signed, and only public HTTPS hosts can receive them.
Minimal data to AI
Engines get your prompts; the writer gets your public site content and Brand Brain. Your email, team and billing details never go to an AI provider.
Only your team, only your data.
Access is enforced twice: in the application and by row-level security policies in the database.
- Workspace data is only readable by members of that workspace; client logins see only the brands they were granted.
- Four roles — owner, admin, member and read-only client. Billing, team, API keys and webhooks require owner or admin.
- Sign-in emails are rate-limited per address and per IP, and free audits per IP and per domain, to stop abuse.
- The platform admin area is limited to an explicit allow-list of operator email addresses.
| Permission | Owner | Admin | Member | Client |
|---|---|---|---|---|
| View dashboards & answers | ||||
| Edit brands, prompts & reports | ||||
| Invite and manage the team | ||||
| Billing | ||||
| API keys, webhooks & Slack | ||||
| Delete the workspace |
Client logins are read-only and limited to the brands they’ve been granted.
Hardened at every layer.
From the headers on every page to the jobs that run in the background.
Transport & storage
- All traffic is served over HTTPS with HSTS.
- Data is encrypted at rest by our database provider.
- CMS credentials are additionally encrypted with AES-256-GCM in a table no browser session can read, and never shown again after you save them.
- No third-party scripts, so nothing else runs on our pages.
Outgoing requests
- Webhooks only go to HTTPS URLs that resolve to public addresses — private and internal networks are refused.
- Each delivery carries a timestamped HMAC-SHA256 signature you can verify.
- The site crawler and publishing integrations only reach public addresses and follow redirects safely.
- Forms can only post to us, or redirect to Stripe Checkout and the billing portal.
Background work
- Scheduled jobs run in short, time-boxed invocations triggered with a secret bearer token.
- Secrets live in environment variables and Supabase Vault, never in code.
- Errors are logged to our own database, not a third-party tracker.
Cost & abuse guardrails
- Per-workspace monthly limits on AI checks, plus a platform-wide daily spend cap.
- Shared rate limits and a circuit breaker per AI engine.
- The AI-referral beacon accepts only rate-limited, minimal payloads.
Exactly what leaves the building.
Measuring AI answers means talking to AI providers. Here is everything we send them, and why.
| What | Sent to | Why |
|---|---|---|
| Your buyer prompts | The engines on your plan — OpenAI, Perplexity, Anthropic, Google | To get the answers we measure. Sent verbatim, with no hint about your brand. |
| Answer text, plus your brand name, aliases, domain and competitor names | Anthropic | To read each answer: mentions, rank, sentiment, competitors and sources. |
| Text from your public homepage | Anthropic | To propose competitors and prompts during onboarding, and as context for weekly recommendations. |
| Your scores, missed prompts and gap domains | Anthropic | To write your weekly recommendations from your own data. |
| Your country | OpenAI, Perplexity, Anthropic | As an approximate location, so web results match your market. |
| Text from your crawled public pages, your Brand Brain and search results | Anthropic | To build the Brand Brain, plan, write and fact-check articles in your voice, and suggest technical fixes. |
| Your domain, competitor domains and keywords | DataForSEO | For keyword research, search results behind articles and community threads, and traffic estimates. |
| Your public page URLs | Google PageSpeed Insights | To measure Core Web Vitals in the technical audit. |
| Featured-image descriptions | OpenAI or Google | To generate an article’s featured image. |
| Finished articles | The CMS or webhook you connect | To publish them — only to destinations you set up. |
Each provider’s API data-use terms apply to this traffic. See their API policies for how they handle and retain requests.
Kept as long as useful. Yours to take.
400days
Full answer text
Raw AI answers are removed after this; aggregated scores are kept for the life of the workspace.
30days
Audit IP hashes
Free-audit IP addresses are only stored as salted hashes for rate limiting, then cleared.
0cookies
AI referral tracking
The snippet records the AI source and page path only — no cookies, no personal identifiers.
Export anytime
Download your workspace data as JSON from account settings.
Delete a brand
Removes its prompts, answers and metrics.
Delete your account
Removes your membership and, for workspaces you solely own, all workspace data.
Who helps us run it.
The companies that process data on our behalf, and what each one receives.
| Provider | Purpose | Data |
|---|---|---|
| Vercel | Application hosting and serverless functions | Requests and application data in transit |
| Supabase | Database, authentication and scheduled jobs | Workspace data, account email |
| Stripe | Payments and subscription billing | Billing details (entered on Stripe) |
| OpenAI | ChatGPT answers to your tracked prompts; featured images for articles | Buyer prompts, image descriptions |
| Anthropic | Claude answers, answer analysis, Brand Brain, article writing and fact-checking, fix suggestions, plans and recommendations | Prompts, answer text, brand & competitor names, crawled public pages, search results |
| Gemini answers to your tracked prompts; PageSpeed Insights for Core Web Vitals; optional featured images | Buyer prompts, public page URLs, image descriptions | |
| DataForSEO | Keyword, ranking and search-results data for research, articles, community threads and traffic estimates | Your domain, competitor domains and keywords |
| Perplexity | Perplexity answers to your tracked prompts | Buyer prompts |
| Resend | Transactional and notification email | Email address and message content |
Found something? Tell us.
Email details and steps to reproduce. We appreciate responsible disclosure, will respond as quickly as we can and keep you updated while we fix it.
support@example.comPlease include
- The affected URL or endpoint
- Steps to reproduce, and what you expected
- The impact you believe it has
- How we can reach you to follow up
Please don’t
- Access or modify other customers’ data
- Run denial-of-service or high-volume tests
- Use social engineering or phishing
Free AI audit
See what AI says about you.
Enter your website. We’ll ask real buyer questions on two engines and show where you appear, who appears instead, and what to fix first.
Your website
- 01Where you appear across AI answers
- 02Who AI recommends instead of you
- 03Every answer, with the sources cited
Free · results in about a minute · or start a 3-day trial