Security & Data Handling

When you submit a URL, our servers fetch that page (and, for a Full Audit or Site Crawler run, up to 30 pages under the same domain) and run it through our analyzer modules. We read the page's HTML, response headers, and — for the render check — a headless-Chrome rendering of it. We do not scan pages you haven't asked us to.

Before fetching any submitted URL, we resolve its DNS and reject the request if it points at a private, loopback, or link-local IP range — including the 169.254.169.254-class range cloud providers use for instance metadata endpoints. This stops a submitted URL from being used to make our servers reach internal infrastructure. Redirect chains are re-validated at each hop rather than only at the original URL.

• PostgreSQL — signed-in users' saved projects, scan history, and AI-visibility scan records live here.
• Redis — short-lived: caches AI-generated answers and suggestions for up to an hour (so a repeated request doesn't trigger a new paid AI call), tracks free-tier usage quotas, and backs the background job queue. SEO audit results are never served from cache — every scan fetches the page live.
• Anonymous, no-signup scans are not tied to an account — see the retention periods in the Privacy Policy.

Two distinct features send data to AI vendors, and only the ones your plan and the site's current configuration actually use are contacted — not every provider listed here is necessarily active at any given time:

• AI-prioritised fix recommendations & keyword tools — send extracted page content or keyword context to an LLM vendor to generate suggestions.
• AI Visibility scans — send your prompts/keywords to search-grounded providers (such as Tavily or Perplexity) and, where configured, to model vendors directly through their APIs (OpenAI, Google, Anthropic — no web search) to check whether their answers mention your brand. Free-tier scans use our in-house search index instead. AI fix suggestions, keyword tools and sentiment use DeepSeek.

We do not send your account credentials, payment details, or unrelated account data to any AI vendor. Every vendor is listed with its purpose on the sub-processors page.

All traffic is served over HTTPS. Passwords are stored hashed, never in plain text. Admin-only routes are gated behind a token compared using a constant-time check plus an optional IP allowlist.

This page describes the mechanics of how scans and AI features work. For your legal rights, retention periods, cookie categories, and how to delete your account or data, see the Privacy Policy. To report a security vulnerability, email [email protected].