Security
You're letting software edit your website. Here's how we keep that safe.
A straight account of how access is handled, what the system is allowed to do, and what you can and cannot ask us to show you. The last part is included because a security page that lists only strengths is marketing.
How it's built
The controls that matter most.
Least access that does the job
Google sign-in with read-only access to Search Console and Analytics. WordPress access through a revocable application password and a tiny helper plugin — never an administrator login.
Encrypted keys
Every token and key is encrypted before it is stored, and never written to logs. This is how your Google and WordPress credentials are held.
Your data walled off from everyone else's
Isolation is enforced at the storage level, not by code remembering to filter. A request without your organisation's context returns nothing at all.
Protected pages
Changes are confined to pages you allow. Checkout, pricing, legal and account pages are hard-excluded regardless of any setting.
Instant revocation
Revoke access from your Google account or from WordPress at any time. Access ends immediately, without contacting us.
A full audit trail
Every change, approval, rejection and undo recorded with who or what did it, why, on what evidence, and what happened next.
No passwords to steal
Sign-in is a single-use link sent to your email. There is no password on your account to leak, guess or reuse.
Hardened by default
Strict security headers on every response, daily backups of your data, and a fetcher that refuses to reach anything inside our own network.
Web content is data, not instructions
Pages we fetch — competitors, search results, your own site — are scanned before they go anywhere near an AI prompt. Attempts to trick the system are logged, not obeyed.
Where your data lives
On servers we run ourselves in Germany, inside the EU. UK data-protection law allows your data to be held there without any extra safeguard.
If your sign-off needs more
What you can and can't ask us for.
No certificate to show you. SearchDone holds no SOC 2 or ISO 27001 certification and has had no external penetration test. What you can ask for is the record of the two internal adversarial security reviews, every finding from which was fixed before any customer data or card touched the platform. If your organisation needs a certificate before it can sign, tell us and we'll be straight about whether we can meet that.
No bug bounty. Reports are welcome — see below — but there is no payment scheme attached.
Who processes your data is published on the data processing page, and you are told before that list changes.
Reporting a vulnerability
Tell us directly, and we will not be difficult about it.
If you find something, email us through the contact page with enough detail to reproduce it. You will get a human reply. We will not threaten anyone for reporting a genuine issue in good faith, and we will tell you when it is fixed.
Safe enough to trust with your website.
Read-only Google access, revocable keys, a saved copy before every change, and an undo button on everything. Free to start.
No card. No contract. Nothing changes without your say-so.