Security
You are being asked to let software edit your website.
That deserves a straight account of how access is handled, what the system is allowed to do, and what has not been done yet. This page includes the second part, because a security page that lists only strengths is marketing.
SearchDone is pre-launch. There is no production deployment, no customer data in it, and no third-party audit. Treat this as the design and its current state, not a certification.
Design
The controls that matter most here.
Least-privilege access
OAuth and scoped tokens rather than stored passwords. Search Console access is read-only. CMS access is a scoped plugin key, never an administrator login.
In buildEncrypted credentials
Tokens and CMS credentials encrypted in the application before they reach the database, and never written to logs. The encryption helper exists in the codebase today.
In buildTenant isolation in the database
Multi-tenancy enforced by Postgres row-level security keyed on organisation, not by application-layer filtering. A query that forgets a WHERE clause returns nothing rather than someone else's data.
In buildPrompt-injection defence
Retrieved web content — competitor pages, search snippets, your own CMS — is treated as data and never as instructions. Injection attempts are logged rather than followed.
PlannedWrite-path restrictions
Changes are confined to paths you allow. Checkout, pricing, legal and account pages are hard-excluded regardless of any policy setting.
PlannedInstant revocation
Disconnect any integration yourself, at any time, without contacting support. Deactivating the plugin ends write access immediately.
PlannedAudit trail
Every action, approval, rejection, integration change and rollback recorded with who or what did it and why.
PlannedTwo-factor authentication
For accounts, along with session management and login history.
Planned
Not yet in place
What we cannot claim.
No third-party audit. No penetration test, no SOC 2, no ISO 27001. Claiming otherwise would be trivially falsifiable and there is no point pretending.
No production environment yet. Nothing is deployed and no customer data has been processed. The controls above describe a design that is partly implemented.
No bug bounty. Reports are still welcome — see below — but there is no formal programme or payment scheme.
Subprocessors are not final. Hosting, database and model providers are settled in principle, but the full list will be published on the data processing page before any customer data is processed.
Reporting a vulnerability
Tell us directly, and we will not be difficult about it.
If you find something, email us through the contact page with enough detail to reproduce it. You will get a human reply. We will not threaten anyone for reporting a genuine issue in good faith, and we will tell you when it is fixed.
Find out what's holding your site back.
Free during early access. Connect Google Search Console and see your own list in minutes.