Security & Data Handling

When you submit a URL, our servers fetch that page (and, for a Full Audit or Site Crawler run, up to 30 pages under the same domain) and run it through our analyzer modules. We read the page's HTML, response headers, and — for the render check — a headless-Chrome rendering of it. We do not scan pages you haven't asked us to.

Before fetching any submitted URL, we resolve its DNS and reject the request if it points at a private, loopback, or link-local IP range — including the 169.254.169.254-class range cloud providers use for instance metadata endpoints. This stops a submitted URL from being used to make our servers reach internal infrastructure. Redirect chains are re-validated at each hop rather than only at the original URL.

• PostgreSQL — signed-in users' saved projects, scan history, and AI-visibility scan records live here.
• Redis — short-lived: caches recent scan results to avoid re-fetching the same page, tracks free-tier usage quotas, and backs the background job queue that runs audits and AI-visibility scans asynchronously.
• Anonymous, no-signup scans are not tied to an account — see the retention periods in the Privacy Policy.

Two distinct features send data to AI vendors, and only the ones your plan and the site's current configuration actually use are contacted — not every provider listed here is necessarily active at any given time:

• AI-prioritised fix recommendations & keyword tools — send extracted page content or keyword context to an LLM vendor to generate suggestions.
• AI Visibility scans — send your prompts/keywords to search-grounded providers (such as Tavily or Perplexity) and, where configured, to model vendors directly (OpenAI, Google, Anthropic) to check whether their answers cite your domain. Free-tier scans use a lighter-weight local-search path where available.

We do not send your account credentials, payment details, or unrelated account data to any AI vendor.

All traffic is served over HTTPS. Passwords are stored hashed, never in plain text. Admin-only routes are gated behind a token compared using a constant-time check plus an optional IP allowlist.

This page describes the mechanics of how scans and AI features work. For your legal rights, retention periods, cookie categories, and how to delete your account or data, see the Privacy Policy. To report a security vulnerability, email [email protected].