Security & Compliance

What we actually have in place - and what we don't claim

We are not SOC 2 or ISO 27001 certified, and we don't claim to be. A formal certification is an external audit process we haven't gone through yet. This page lists the real, currently-implemented practices instead - so you can evaluate us on what's actually true today.

Data protection in transit and at rest

  • All traffic is served over HTTPS/TLS.
  • OAuth tokens (Google Search Console, Google Business Profile) are encrypted at rest, not stored as plaintext.
  • Admin sessions and API keys are stored as salted hashes - the raw secret is shown once at creation and never persisted or logged.

Application-layer protections

  • CSRF protection on session-authenticated state-changing requests.
  • Payment webhooks (Razorpay, Stripe) are signature-verified and idempotency-checked, so a replayed or forged delivery can't double-charge or forge a plan upgrade.
  • Rate limiting on public and API-key-authenticated endpoints.
  • An internal audit log records sensitive actions - data exports, account deletions, admin-issued API keys - with actor and timestamp.

Your data rights, self-serve

You don't need to email support and wait for these:

  • Access & portability - download everything tied to your account from Dashboard → Privacy & Data.
  • Erasure - delete your account and data from the same page. Billing/invoice records are kept only as long as tax law requires - see our deletion policy for the exact retention split.

What we're not claiming

  • No SOC 2 Type I/II report.
  • No ISO 27001 certificate.
  • No formal GDPR compliance attestation from a third party - the self-serve data rights above are real, but "GDPR compliant" as a certified status requires broader legal/organizational work beyond this codebase.

If your organization requires one of these for a vendor contract, contact us - happy to talk through what a real audit would take for our size.