Security and trust
Your rankings, your keys, your server.
Self-host for full control, or run on Cloud with published sub-processors and the same BYO-provider model.
AGPL-3.0HTTPSYou own the data
Encryption in transit and at rest
Hosted routes use HTTPS, and provider credentials are encrypted before they are stored. API keys are stored as hashes, not raw bearer secrets.
Self-host for full data residency
Self-hosted deployments keep the app, database, rank history, sessions, provider credentials and audit logs in infrastructure you operate. Self-host runs with no sub-processors.
Your provider keys stay yours
Bring your own SERP and analytics providers. Credentials stay scoped to your project, are encrypted at rest, and provider costs remain between you and the provider.
Access control, RBAC and audit logs
Owner, Admin, Editor and Viewer roles gate project access, and an Auditor role can read audit records. Sensitive account, team, provider, key, schedule and data changes write redacted append-only audit records.
Compliance and data processing
Security reviews can map clear data boundaries: Cloud sub-processors are listed below, self-host has none, and teams can export data through CSV, JSON packages and the REST API.
Responsible disclosure program
Please report suspected vulnerabilities privately. We acknowledge security reports within 48 hours and credit reporters when appropriate.
Report a vulnerability
We acknowledge reports within 48 hours and credit reporters.
Sub-processors
Cloud only. Self-host runs with no sub-processors.
| Sub-processor | Purpose | Scope |
|---|---|---|
 AWS | Application hosting, managed databases and transactional email (SES) | Infrastructure |
 Hetzner | Workflow engine, background workers and cache infrastructure | Workers |
 Resend | Transactional email delivery | |
 Sentry | Error and performance monitoring | Diagnostics |
 PostHog | Product analytics | PlannedAnalytics |
 Stripe | Subscription billing and payments | PlannedBilling |
Logos provided by Logo.dev