Security
This page says the same things as the trust boxes in the setup wizard. When the code changes, so does this page.
| You give | seops reads | seops keeps | |
|---|---|---|---|
| Site ownership | You add a DNS TXT record, a file or a meta tag to your domain. | Only the verification code seops gave you; no other DNS records or page content. | The verification date. A site not verified within 7 days is deleted with its data. |
| Search Console | You add seops's service account to the property as a Restricted user (Full only to submit sitemaps). | Clicks, impressions, position, queries, pages and URL index status. It cannot change Search Console settings. | Reports cached 15 minutes to 36 hours; rank history and URL inspection results in the database. Data is shown only to the account that verified ownership. Remove the permission in Search Console any time. |
| Google Analytics 4 | You add the service account with the Viewer role. | Aggregated reports: users, sessions, channels, pages, devices, cities. No user-level data; settings cannot be changed. | Reports cached; weekly summaries stored. Remove the role in Admin → Property access management any time. |
| seops Analytics | You put a 2.1 KB script tag (1.2 KB compressed) on your own site. No cookies, no browser storage, no persistent identifier. | Page path (the query string is not sent; only UTM tags, the presence of an ad click ID and the site-search parameter you allow with data-search), referrer, UTM parameters, screen width class, language, time on page, scroll depth and the events you send. The visitor's IP address and user agent are used only in memory: country, region and city, browser and OS family, bot filtering, and a daily visitor hash (SHA-256 of a daily salt, IP, user agent and site key). | Raw hits 90 days on Cloudflare Analytics Engine; daily summaries while the site exists; each day's salt is deleted two days after that day ends; raw IP and user agent are never stored or logged. You are the controller, seops your processor under the Data Processing Addendum. |
| Cloudflare | You create an API token with read-only permissions for this site's zone. | Security events, bot and AI crawler traffic, request counts. Read-only, so Cloudflare settings cannot be changed. | Stored encrypted (AES-GCM); only the last 4 characters are shown; used only for this site. Delete here or revoke in Cloudflare. |
| Bing and Yandex | A Bing Webmaster API key; a Yandex OAuth token with Webmaster permissions. | Reports only: clicks, impressions, queries, crawl status, index, site issues. | Stored encrypted (AES-GCM); last 4 characters shown. A Bing key technically allows URL submission; seops does not use that. |
| IndexNow | You place the key file seops generated at your site root. An IndexNow key is public by design. | Your sitemap. Only page URLs are sent to Bing and Yandex. | Submitted URLs and response codes in the submission history. |
| AI apps over MCP | You approve an app such as Claude on the seops consent page. | Only your workspace's reports, tasks and prompt history; it can add or update tasks, prompt records, drafts and security findings. It cannot change settings, sites or connections. | Access tokens last 1 hour, refresh tokens 30 days. Remove under My account → Connected AI apps. |
| Prompt history | Nothing; agents write the request and their summary at the end of each reply, if logging is on. | Keys, passwords and tokens are masked before saving. You can mask an entry permanently or lock it with a password. | Locked entries are encrypted with your password, which is stored nowhere; AI agents cannot read them. Turn logging off any time. |
| Bluesky | An app password, only if you use Content and sharing. | Only to publish the posts you approve. | Stored encrypted (AES-GCM); last 4 characters shown; used only for that site. |
| WordPress, Hostinger, Supabase (backups) | Nothing in the panel. These credentials are set as Cloudflare Worker secrets by the seops operator; you do not paste them into seops. | Backup status and row counts. | Worker secrets are never shown in the panel or written to logs. |
| AI model providers | Nothing by default. When you use “Generate with AI” you pick Claude, ChatGPT or Gemini. | The text you enter and the relevant report go through Cloudflare AI Gateway to that provider; under their API terms it is not used for training. | The generated draft, in your library, until you delete it. |
| Billing | Your payment details go to Paddle, our merchant of record, never to seops. | Customer ID, subscription status, capacity and billing period from Paddle webhooks. | Billing events as long as tax law requires. Invoices and payment methods live in the Paddle customer portal. |
Never
- Data is never sold, used for ads or shared to train AI models.
- No advertising or tracking cookies; one HttpOnly session cookie, stored server-side as a SHA-256 hash.
- seops Analytics on your site: no cookies, the IP address is hashed with a daily salt and never stored, raw hits expire after 90 days.
- Google scopes are read-only. seops cannot change your Search Console or Analytics.
- Integration keys are never shown again after you paste them.
- You can delete your account and all data from My account; deletion completes within 30 days.
Infrastructure
- Cloudflare Workers, D1 and R2; no servers of our own.
- Panel admin access behind Cloudflare Access (zero trust).
- Content Security Policy with no third-party scripts except Cloudflare Web Analytics.
- CSRF: same-origin and JSON-only writes; parameterised SQL everywhere.
- Nightly D1 backups to R2, 30 daily and 12 weekly copies.
How your data is protected
Keys are encrypted at rest
Every key you paste in the panel (Cloudflare token, Bing API key, Yandex token, Bluesky app password) is encrypted with AES-GCM under a server-side data key before it reaches the workspace_secrets table. The panel keeps only a 4-character hint for display; the plaintext is decrypted in memory when a report needs it and never returned to the browser.
Prompt history is masked, and can be locked
Before an agent's request or summary is saved, passwords, tokens, API keys and similar values are replaced by a mask on the server. You can also lock entries with a password of your own: the content is encrypted with a key derived from it (PBKDF2-SHA256, 100,000 rounds, AES-GCM 256) and the password itself is stored nowhere, so neither seops nor an AI agent can read a locked entry.
Exclusions keep noise and private paths out
Per project you can exclude paths, queries, countries, domains and crawlers, globally or per report. Excluded items are dropped from reports, audits and what agents read over MCP; the data itself is not deleted, so you can undo it.
Admin access is Access plus JWT
The platform admin area sits behind Cloudflare Access, and the Worker verifies the Access JWT (Cf-Access-Jwt-Assertion) against Cloudflare's JWKS on every request, with an allowed-email list; a missing or wrong configuration fails closed. Users sign in with Google and get an HttpOnly session cookie.
The demo has no secrets
demo.seops.app is a separate Worker with its own database and no secrets defined at all; the deploy refuses to start if one is set. Search Console, Analytics, Cloudflare, Bing, Yandex and PageSpeed are replaced by a built-in mock, so no request leaves for a third-party API, and nothing you do there is saved.
Status
Live check, cached for 60 seconds.
Where the data lives
| Data | Where | How long |
|---|---|---|
| Account, workspaces, sites, tasks | Cloudflare D1 (WEUR) | Until you delete the account; deletion within 30 days |
| Report cache (Search Console, GA4, Bing, Cloudflare) | Cloudflare D1 | 15 minutes to 36 hours |
| Rank history, URL inspections, AI answers | Cloudflare D1 | Until the project is deleted |
| seops Analytics hits (visits on your site) | Cloudflare Analytics Engine; daily summaries in D1 | Raw 90 days; summaries until the site is deleted; each day's salt deleted 2 days after the day ends; raw IP never |
| Integration keys | Cloudflare D1, AES-GCM | Until you remove them; only the last 4 characters shown |
| Backups (D1, Supabase, WordPress) | Cloudflare R2 | 30 daily + 12 weekly copies |
| MCP OAuth records | Cloudflare KV | Access 1 hour, refresh 30 days |
| Billing events (Paddle webhooks) | Cloudflare D1 | As long as tax law requires; card data only at Paddle |
| This site's waitlist and newsletter | Cloudflare D1 (WEUR) | Until you opt out (contact@seops.app) |
Report a security issue: contact@seops.app · Privacy policy · Data Processing Addendum · Subprocessors
まずは 1 サイトを無料で
最初の 1 サイトはカード不要でずっと無料。追加サイトは月 2.50 ドルです。