Security

Summary: We encrypt your stored API keys with AES-256-GCM, hash passwords with bcrypt, use HTTPS everywhere and keep access to production to a minimum. Each site's data is checked against its owner on every request. Found a security issue? Email support@agenticseo.com. This summary helps you read the page; the full text below is what applies.

AgenticSEO holds keys to your AI provider, Google and publishing accounts, so we treat security as a core part of the product. This page explains what we do today. We do not hold SOC 2 or ISO 27001 certification.

How we protect your data

Your third-party keys

• API keys, service account keys and access tokens (for example for your AI provider, Google, DataForSEO, PostHog, X and your CMS) are encrypted with AES-256-GCM before they are stored. Each value gets its own random IV and an authentication tag, so tampering is detected.
• The encryption key is kept apart from the database, in the server's environment.
• Keys are decrypted only on the server, only when a job needs them. We do not show full keys back in the app.

Your account

• Passwords are hashed with bcrypt. We never store or see your password in plain text.
• Sign-in uses a random session token in an HttpOnly, Secure, SameSite=Lax cookie. We store only a hash of the token. Sessions end after 30 days or when you log out.
• Password reset links use one-time random tokens that expire. We store only a hash of each token.
• Google reCAPTCHA protects sign-up, login, password reset and review pages from bots and password guessing.

In transit

• All traffic to the Service uses HTTPS (TLS).
• Calls from the Service to AI providers and other connected services use HTTPS.

Separation between customers

• Every page and action that uses a site checks that the signed-in user owns that site.
• Review links use long random tokens, and you can revoke them at any time.

Access and operations

• Least access: only people who need production access to run and support the Service have it, and only to the level they need.
• The Service runs on [Hosting provider — set COMPANY_HOSTING], which provides physical and network security for its data centres.
• We back up the database regularly.
• We keep software dependencies up to date and fix security issues by priority.

Your content and AI

• We do not use your content to train AI models.
• AI requests go to the AI providers we use, under our agreements with them.

What you can do

• Use a strong, unique password.
• Give each key only the permissions it needs. For example, add the Google service account as a restricted user or Viewer, and use a CMS account with only the rights needed to publish.
• Set spending limits with your AI provider.
• Remove keys you no longer use, and revoke review links you no longer need.

Incidents

If a personal data breach affects your data, we will tell you without undue delay, and within 72 hours for customers covered by our Data Processing Agreement, and as the law requires.

Report a security issue

If you think you have found a security issue in AgenticSEO, email support@agenticseo.com with "Security" in the subject. Please include the steps to reproduce it and its possible impact.

When you look into an issue, please:

• test only against your own account and data;
• do not access, change or delete other customers' data;
• do not run denial-of-service tests, spam or social engineering;
• give us a reasonable time to fix the issue before you share it publicly.

We will confirm we received your report, keep you updated, and credit you if you want. We will not take legal action against people who report issues in good faith and follow these rules.

Questions

Security questions or questionnaires: support@agenticseo.com