How your data is kept apart, and what we have not certified yet.
This describes the controls as they exist in the code today. It also lists, plainly, the certifications we do not hold, because an agency handing us client credentials deserves that answer before the sales call.
Workspace isolation is structural, not careful
Every database query that touches customer data takes the workspace identifier as its first argument, and every index on those collections leads with it. A query that forgets the workspace fails rather than silently crossing into another client’s data.
A record that belongs to a different workspace answers as not found, never as forbidden. There is no response that confirms another client’s record exists.
Connected credentials are write-only
- Credentials you connect (Google Search Console, GA4) are encrypted with AES-256-GCM before they are stored.
- The encryption key for each workspace is derived from a master key using HKDF, so one workspace’s key cannot decrypt another’s.
- No API endpoint returns a credential in plain text. Reads give the name, a four-character preview and the date it was set. The plain text exists once, at the moment you enter it.
Sign-in
- There are no passwords to leak. Sign-in is by one-time code to your email or by Google.
- Sessions use a same-origin cookie and are tied to your workspace.
What our crawler does on your site
- It respects robots.txt, identifies itself with a user agent that links back to this site, and reads only publicly reachable pages.
- The free audit reads two URLs, robots.txt and the homepage, and stores nothing.
Infrastructure
- System of record: MongoDB Atlas. Vector storage: Pinecone, one namespace per workspace. Embeddings: Google Gemini.
- All traffic to this site and the API is over HTTPS.
- Hosting region and backup schedule: to be confirmed.
What we do not have yet
We are not SOC 2 certified and have not completed an independent penetration test. We do not run a bug bounty. If a certification appears on this page in future it will link to the report; until then, the answer is no.
Reporting a vulnerability
Email overflowsearch@gmail.com with the details. We will acknowledge within two working days and tell you what we did about it. Please do not test against other customers’ workspaces.