Security Overview

Access control

• Every agency's data is separated at database level with row level security, so one agency can never read another's data.
• Roles for owners, admins, staff and view-only client logins.
• Two-factor authentication for all users by emailed code. A browser is trusted for 14 days of activity and asked again when it signs in from a new IP address.

Data protection

• All traffic is encrypted in transit with TLS.
• Data is stored encrypted at rest by our hosting provider, with daily backups.
• Passwords are hashed and never visible to us.
• API tokens are stored hashed and can be revoked at any time.

Monitoring

• Every change to clients, locations, keywords, competitors and teams is written to an audit log.
• Login, two-factor and security events are recorded and reviewed.

Incidents

We have a documented incident response process and will notify affected agencies of a personal data breach within 48 hours where possible.

Reporting a vulnerability

Please contact us through the website. We investigate every report.