This page describes how AutomateSEO protects customer data. It is the customer-facing summary of the technical and organisational measures in Annex 3 of our Data Processing Agreement.
We have written it to be accurate rather than impressive. Where we do not yet hold a certification or run a control, we say so.
1. Architecture
AutomateSEO runs on managed cloud infrastructure rather than servers we operate ourselves:
- Application — Next.js on Cloudflare Pages and Workers, served from Cloudflare's global edge network with DDoS protection in front of it.
- Database and authentication — Supabase (managed PostgreSQL), hosted on AWS in eu-west-1 (Ireland). Your account data, business profiles and article records are stored in the EU.
- Object storage — Cloudflare R2 for generated images, audio and video.
- Content workflows — n8n Cloud, EU-hosted in Germany.
- Payments — Stripe. Card data never touches our infrastructure.
Full details of every provider are on the Subprocessors page.
2. Encryption
In transit. TLS 1.2 or higher on every connection, enforced end to end — browser to edge, edge to database, and on every outbound call to AI providers and connected platforms. HTTPS is mandatory; HTTP requests are upgraded.
At rest. The database, object storage and all backups are encrypted at rest by the underlying platform.
Application-layer encryption for credentials. Every third-party credential you give us — WordPress passwords, GitHub tokens, OAuth access and refresh tokens, webhook secrets — is additionally encrypted with AES-256-GCM before it is written to the database, using a key held outside the database in the platform's secret store. A database compromise alone does not expose your connected accounts.
Passwords. Handled by Supabase Auth and stored as bcrypt hashes. We never see or store your password. Google sign-in is supported and avoids a password entirely.
3. Access control
Between customers. PostgreSQL row-level security isolates each customer's data at the database engine, not just in application code, so a bug in a query cannot return another customer's rows.
Within the application. Role-based access control. Workspace and collaborator permissions are checked on every request. Service credentials follow least privilege.
By our team. Administrative access is limited to named personnel on a business-need basis, requires multi-factor authentication, and is reviewed regularly. Access is revoked the day an engagement ends. We do not access customer content except where you ask us to for support, or where we must investigate a security or abuse incident.
Machine-to-machine. Callbacks from content workflows are authenticated with signed secrets. Partner and API keys are scoped and revocable.
4. Application security
- Authentication on API endpoints, with a shared authentication resolver used consistently across routes rather than per-route ad hoc checks.
- Output sanitisation on all rendered content. This matters here more than in a typical app: article bodies are assembled from scraped competitor pages and raw model output, and are then rendered into an authenticated dashboard. Every such sink passes through a central sanitiser with a strict allowlist that strips scripts, event handlers, embedded browsing contexts and unsafe URL schemes.
- Rate limiting on the partner API and on the public chat endpoint. Broader rate limiting across the remaining public endpoints is in progress; see section 6.
- Secret management — credentials live in the platform secret store, never in the repository.
- Dependency monitoring for known vulnerabilities.
- Security review of changes before release.
5. Availability and recovery
- Managed, replicated database hosting with automated daily backups and point-in-time recovery.
- Compute and content delivery distributed across a global edge network.
- Generation and publishing jobs persist their state, so work can be retried after a failure without data loss, and credits are returned automatically when a job cannot be recovered.
- Backups are retained on a rolling 90-day cycle and are encrypted.
We do not currently publish an uptime SLA for self-serve plans. Business customers can agree service levels in a signed order form.
6. Security testing and assurance
What we do: a full application security audit was completed in July 2026 covering every API route, all database migrations and policies, the payment integration, the workflow layer and the in-app AI agent. Every finding is recorded with a fix order and re-verified against the code when it is closed. We monitor dependencies for known vulnerabilities and review changes before release.
What we do not yet have, stated plainly:
- Remediation of the July 2026 audit is in progress, not finished. We would rather say that than imply a clean bill of health. If you are evaluating us for a business deployment, ask us at security@automateseo.app where remediation currently stands and we will tell you.
- We are not SOC 2 certified.
- We are not ISO 27001 certified.
- We do not currently run continuous third-party penetration testing.
- We do not operate a paid bug bounty programme.
We will update this page if that changes. We would rather tell you this now than have you discover it during a procurement review.
7. Reporting a vulnerability
Email security@automateseo.app. Please include enough detail to reproduce the issue.
We commit to acknowledge within 2 business days, keep you updated on remediation, and credit you publicly if you would like that.
Safe harbour. If you research in good faith, report privately, give us reasonable time to fix the issue before disclosing, and do not access, modify, delete or exfiltrate data belonging to anyone else, we will not pursue legal action against you and will treat your research as authorised.
Please do not run automated scanners against production, attempt denial of service, or use social engineering against our staff or customers.
8. Incident response
We maintain a documented incident response process covering detection, containment, assessment, notification and post-incident review.
If a personal data breach affects your data, we will notify you without undue delay and within 48 hours of becoming aware, with what we know at the time and updates as the investigation progresses. Where we are the controller, we will notify the ICO within 72 hours where the breach meets the threshold, and notify affected individuals directly where the risk to them is high.
We will not delay telling you in order to finish investigating.
9. Your side of the shared responsibility
Some things are yours to get right:
- Use a strong, unique password, or sign in with Google.
- Control who you invite to your workspace, and remove collaborators when they leave.
- Rotate connection credentials if you suspect they have been exposed, and revoke connections you no longer use.
- Secure any custom webhook endpoint you configure — we send content to whatever address you nominate.
- Review what gets published, particularly if you have enabled automated publishing.
- Tell us immediately at security@automateseo.app if you think your account has been accessed without authorisation.
10. Security questionnaires
Business customers evaluating us can request our security documentation, a completed security questionnaire, and a countersigned DPA from security@automateseo.app. We aim to turn these around within 5 business days.
Last reviewed: 23 August 2026.