Security
How we handle your data
How Seoptist handles data: official AI provider APIs only, no scraping or fake accounts, raw answers stored in UK object storage, UK hosting, UK GDPR compliance, named sub-processors, encryption, retention and export.
Official APIs only
AI answers come from the OpenAI, Google Gemini, Perplexity Sonar and Anthropic APIs, and from licensed SERP data providers for Google AI Overviews and AI Mode. We never automate consumer chat interfaces, never create accounts on your behalf and never scrape.
UK hosting
Application servers, databases and object storage run in UK regions. Backups stay in the UK. AI provider APIs are called from the UK; those providers process the prompt text under their own terms (see sub-processors).
Your site, crawled politely
Our crawler identifies itself as Seoptist-Audit, obeys robots.txt, makes at most two requests per second and stops at your plan's page limit. You can exclude paths at any time.
Raw answers kept, versioned
Every AI answer we receive is stored verbatim in object storage with its prompt, engine, model, timestamp and sample number, so every score can be traced back to evidence. Nothing is paraphrased before storage.
Encryption and access
TLS 1.2+ in transit, AES-256 at rest for databases and object storage. API keys and OAuth tokens are encrypted with a separate key. Staff access is role-based, logged and limited to support cases you open.
Read-only Google access
Search Console and GA4 connections use OAuth with read-only scopes. We never write to your Google properties. Disconnect at any time from Settings and tokens are deleted immediately.
Data inventory
What we store, for how long, and why
| Data | Examples | Retention | Why |
|---|---|---|---|
| Account data | Name, email, organisation, billing details | Life of the account + 30 days | Required to provide the service |
| Brand profile | Domain, sector, locations, competitors, prompts, fact card | Life of the account + 30 days | You enter this; it drives what we measure |
| Crawl data | Public pages of your website, rendered HTML, screenshots | Last 12 scans or 12 months | Public information you ask us to audit |
| AI answers | Raw API responses for your prompts | 24 months (Enterprise: configurable) | Evidence for every score; needed for trends |
| Google data | Search Console queries, GA4 sessions and conversions | 16 months rolling | Read-only, only if you connect |
| Usage logs | Logins, actions, API calls, IP addresses | 12 months | Security and abuse prevention |
Sub-processors
Who else touches the data
Each provider is under a data processing agreement. Prompt text (never your account details) is sent to AI providers to obtain answers.
OpenAI
ChatGPT answers via API
USA (DPA, SCCs)
Google Cloud
Gemini API; Search Console and GA4 read access
EU/UK regions where available
Perplexity AI
Perplexity Sonar API
USA (DPA, SCCs)
Anthropic
Claude API; internal analysis and checklist text
USA (DPA, SCCs)
DataForSEO and SerpApi
Licensed search, AI Overview and keyword data
USA/EU (DPA)
Stripe
Payments and invoicing
EU/UK (PCI DSS Level 1)
Cloudflare
DNS, TLS, bot protection (Turnstile)
Global edge; UK data centre
Transactional email provider
Account and report emails
EU/UK
FAQ
Security questions
Do you train AI models on my data?
No. We do not train models on customer data, and our API usage with OpenAI, Google, Perplexity and Anthropic is under business terms where inputs are not used for training.
Can I export or delete everything?
Yes. Export checklist, findings and AI answers as CSV or PDF from the app at any time. Request deletion from Settings or by email; we delete within 30 days and confirm in writing.
Is there a Data Processing Agreement?
Our standard DPA is incorporated into the Terms of Service for all plans. Enterprise customers can sign a bespoke DPA with custom retention periods.
How do I report a vulnerability?
Email [email protected] with details. We acknowledge within two working days and do not pursue good-faith researchers.
Find out what AI assistants say about you today.
Run the free check in two minutes, or start a trial and get your full SEO and GEO checklist this week.
No card needed for the free check. Prices exclude VAT.