Security

Your Google connection

Connecting Google is the most sensitive thing you do in this product, so it gets the most care:

• We use Google's OAuth flow. Your Google password is never seen by us, typed into us, or stored by us.
• Access and refresh tokens are encrypted with AES-256-GCM before being written to the database. The encryption key lives in the server environment, never in the database beside the ciphertext.
• Tokens are excluded from database reads by default and are never returned by our API or rendered into a page.
• We request one scope — business.manage — because it is the scope Google provides for this work. We do not ask for mail, contacts, calendar or drive access.
• You can revoke our access at any time from your Google account, and disconnecting inside the product deletes the stored tokens.
• A Facebook Page, Instagram account or LinkedIn page you connect, and the application password for a WordPress site, are stored the same way: encrypted with the same envelope, never selected by default, deleted when you disconnect.

Your data

• All traffic is served over HTTPS.
• Every request is scoped to your workspace before it reaches the database, so one customer's session cannot read another customer's listing — including through a guessed identifier in a URL.
• Passwords, where you use one, are stored as hashes. We cannot read them and cannot tell you what yours is.
• Access to production data is limited to the people who need it to keep the service running.

Deleting everything

Deletion is self-serve and immediate. Disconnect a Google account to remove its tokens, delete a business to remove that listing and everything computed from it, or delete your account to remove all of it at once. Details are in the Privacy Policy.

What we do not claim

We are a young product and we would rather be trusted than impressive. We are not currently SOC 2 or ISO 27001 certified, and we do not hold a formal penetration-test report. When that changes, this page will say so with a date and an auditor’s name — not before.

Reporting a vulnerability

If you find a security problem, email [email protected] with enough detail to reproduce it. We will acknowledge within 2 business days, keep you updated while we fix it, and credit you if you would like to be named. Please do not run automated scanners against production or access another customer’s data — report the route in and we will verify it ourselves.

If something goes wrong

If a breach affects your data, we will tell you what happened, what was involved and what to do about it — without waiting until we have a complete picture, and within the timeframes the law requires of us.