Security

Plain answers about your data.

What we store, where it lives, who can see it, and who helps us run the service. Security questions and reports go to [email protected], and a person replies.

Email security questions Read the Privacy Policy

Short answers

The five questions we get most.

Where is my data stored?

In the United States, on Amazon Web Services.

Is it encrypted?

Yes, in transit and at rest. Credentials for tools you connect are encrypted again before they are stored.

Can other customers see it?

No. Each organisation's data is kept separate in the database, and only members of your workspace can see it.

Do you change anything in my accounts?

Not without you. Google connections are read-only. A fix is published to WordPress only after you preview and confirm it.

Do you hold SOC 2 or ISO 27001?

Not today. We would rather say so than imply it. Ask us anything a questionnaire would.

In detail

How the service handles data.

Collect

What we store

Your account details, the brands you track (domain, competitors and questions), the AI answers we capture for them with their sources, and data from tools you choose to connect. Card and bank details are collected by our payment provider, not by us.

Protect

Encryption and isolation

Traffic is encrypted in transit and data is encrypted at rest. Access tokens and keys for connected tools are sealed with AES-256-GCM before they are written to the database. Every organisation's rows are isolated by row-level security in the database, so one workspace cannot read another's.

Connect

Read-only connections

Search Console and Google Analytics ask Google for read-only scopes, one product per consent screen. Cloudflare reads analytics for the zone you pick. Disconnect any tool on the Integrations page and we delete our stored token.

Access

Signing in

You sign in with a one-time code sent to your email, or with Google. We do not store passwords.

Site

This website

Analytics on proofsource.co run without cookies until you accept them. With consent, session replays mask anything typed into a form field, and the contact form is never recorded.

Delete

Export and deletion

To get a copy of your data, or to delete your account and everything in it, email [email protected]. Tables in the app also export to CSV or JSON.

Subprocessors

Who helps us run the service.

Each provider gets only what its job needs. We do not sell personal data or share it with advertisers.

Category	Provider	What it does for us
Cloud hosting and database	Amazon Web Services	Runs the app and stores your data, in the United States
Website delivery	Cloudflare	Serves this website
AI engines and models	OpenAI, Anthropic, Perplexity	Answers the buyer questions we measure, and reads answers for analysis
Search and web data	DataForSEO, Firecrawl, TinyFish	Google AI Overviews results, and reading public web pages
Email and notifications	Resend, Knock	Delivers emails and in-app or Slack notifications
Payments	Dodo Payments	Merchant of record: bills you and handles sales tax
Website analytics	PostHog	Anonymous page views, and more only with your consent

Tools you connect, such as Google or Slack, receive data because you asked us to send it. Questions about this list go to [email protected].

Responsible disclosure

Found a vulnerability? Tell us first.

Email [email protected] with "Security" in the subject and the steps to reproduce. Please do not access other customers' data, run denial-of-service tests or send us personal data you found. We reply, fix, and tell you when it is fixed.

Contacts

Security reports and questions: [email protected]
Privacy and data requests: [email protected]