Security

We take the security of your data seriously. Here's how we protect it.

Encryption at Rest & in Transit

All data is encrypted at rest in our PostgreSQL databases. Third-party integration tokens (Google Search Console, Slack, etc.) are encrypted using AES-256-GCM before storage. All communications use TLS 1.3.

Authentication & Access Control

We use Google OAuth for authentication — we never store passwords. All API routes are protected by session-based middleware. Admin functions require explicit email-based role verification.

Infrastructure & Data Isolation

Each workspace operates in a tenant-isolated model — all database queries are scoped by workspace ID. API keys are encrypted, and Stripe handles all payment card data (PCI DSS compliant). We never store credit card numbers.

AI Data Processing

Your prompts and company data are sent to AI providers (Google Gemini, Anthropic Claude) for visibility analysis only. We do not use your data to train AI models. AI responses are processed server-side and never exposed to other users.

Report a Vulnerability

If you discover a security vulnerability, please report it responsibly to security@aivisibility.io. We respond to all reports within 48 hours.