Security
Last updated: 2026-11-09
At a glance
- Connections to the app and to Google are encrypted (HTTPS).
- Google access tokens are stored encrypted with AES-256-GCM, with the key kept outside the database.
- The server limits every data request to your workspace and the projects you have access to.
- Search Console and Google Analytics 4 are connected read-only: we cannot change anything in them.
- External services get only the data a feature needs, and AI model providers do not train on it.
- You can turn on two-step verification, and administrative access always requires it.
Accounts and sign-in
- Sign in with e-mail and password or with Google. Passwords are stored only as hashes.
- Two-step verification with an authenticator app (TOTP) for every account.
- Rate limits on sign-in and sign-up protect against password guessing.
- Team roles: owner, editor, writer and reader. The owner decides who sees project data.
- The admin panel is available only to authorised people and only after two-step verification. Every credit adjustment needs a reason and is logged.
Google data
Rankovio connects to Google only when you connect a project yourself on Google's consent screen, and only read-only.
Service | Scope | Why |
|---|---|---|
Google Search Console | webmasters.readonly | Visibility reports, refresh list, article impact, ideas |
Google Analytics 4 (optional, separate consent) | analytics.readonly | Organic traffic and visits from AI assistants |
Google account | openid, email | Showing which account is connected |
When you disconnect, we revoke the grant at Google and delete the tokens. If Google does not confirm the revocation, we delete nothing and show an error so you can try again.
Rankovio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We never sell Google data or use it for advertising or to train AI models. The privacy policy has the details: https://rankovio.com/en/privacy.
External services and AI
Provider | Used for | What it gets |
|---|---|---|
DataForSEO | Google results, keyword and domain data, AI engine answers | Keywords, domains, prompts, country and language; no data from your Google accounts |
OpenRouter (OpenAI and other models) | Briefs, drafts and text scoring | Working text, order notes, material from your pages, keywords, and the topics and structure of ranking pages, not their full text |
Jina | Reading pages of your site as draft material | Page URLs |
Requests to AI models carry a setting that forbids providers from collecting or training on the data sent. Page content and keywords are treated as data, never as instructions to the model.
Fetching pages
- We fetch pages with an honest User-Agent and a per-site rate limit.
- We block private network addresses and check every redirect, so fetching cannot reach internal infrastructure.
- Copies of ranking pages are kept for at most 7 days; after that only computed features remain.
How long we keep data
Data | Period |
|---|---|
Search Console and GA4 data | 16 months back; older days are deleted daily |
GA4 data after disconnecting | Deleted immediately |
Records of requests to AI models | 90 days |
API and MCP key usage history | 90 days |
Copies of your pages used as material | 30 days |
Copies of ranking pages | 7 days |
The full list and how to delete your account are in the privacy policy: https://rankovio.com/en/privacy.
Report a security issue
If you find a vulnerability, write to [email protected] with the subject “Security”. Describe the issue and the steps to reproduce it. Do not access other users' data or disrupt the service. We will confirm receipt and let you know about the fix.