Security
How we protect your data and your clients' data
We checked every line on this page against our code and our providers' terms on October 26, 2026, and we claim no certification we do not hold.
Checked against the code, October 26, 2026
Where your data lives
Your account and websites are stored in Singapore
Your account and your websites are kept in our database in Singapore, and the app's servers run in the same region.
- Database: Supabase, on AWS in Singapore (ap-southeast-1)
- App servers: Vercel, in Singapore
- You can delete your account yourself on the Team page once any paid plan has ended and other members are removed. It deletes your account, workspace, websites and audit history from our database. Report files already made and Google copies stay.
Some work happens outside Singapore: payments, email, search and link data, error reports, AI models, product analytics and Google reports. The provider table says which.
Who can see your data
Your workspace, the people you invite, and our support team
Before our servers return a website, an audit or a setting, they check that you belong to its workspace or hold its share link.
- A client you invite sees only the websites you share with them, not your whole workspace.
- The in-app assistant's tools are limited to the workspace you are signed in to.
- PDF audit reports open for anyone with their link, and stay after you delete your account.
- Reports and articles you export to Google Sheets, Slides or Docs open for anyone with their link, and Sheets links can also edit, so share them with care.
- SearchBlueprint staff on a named list can open customer websites to give support.
- When a staff member signs in as a customer from our admin page, we record who, whose account and when. The session ends after 8 hours.
AI
How our AI treats text from the web
A web page can hide text written to trick an AI. Our AI Deep-Dive, Mobile CRO and Schema audits mark the website text they read as untrusted before the AI sees it, and tell the AI to treat it as information, not instructions.
- Anthropic, our main AI provider, does not train its models on data we send through its API.
- We don't train AI models on your data.
- Audits, AI writing and other heavy actions are rate-limited.
Sign-in and payments
Sign-in by email, payments by Stripe
- Sign-in
- You sign in with a link sent to your email. A link works for 14 days and more than once. A new account opens at once, and some actions wait until you open a link from your inbox. Sign-in requests are rate-limited.
- Payments
- You enter card details on Stripe's checkout page. We never receive your full card number.
- Connections
- The access you give us to publish to your website or to read Google Search Console and Analytics is encrypted with AES-256-GCM before it is stored.
- Sign-in and API keys
- Sign-in links and API keys are stored as hashes, not as the key itself.
- In transit
- All traffic uses HTTPS, and browsers are told never to connect without it (HSTS). Pages carry standard security headers, including a content security policy.
Providers
The main providers we use
| Job | Provider | What it receives |
|---|---|---|
| Database and sign-in | Supabase | Your account and websites. Singapore. |
| Hosting | Vercel | Every page and request. App servers in Singapore; pages are delivered through Vercel's worldwide network. |
| Payments | Stripe | Card and billing details, entered on Stripe's own page. |
| AI models | Anthropic, OpenAI, Google | What a task works on: page copy, page screenshots, keywords, files you upload and your instructions. |
| Reports and exports | Reports and exports in Google Sheets, Slides, Docs and Drive, and our internal list of accounts and their websites. | |
| Search data | DataForSEO | The domains and keywords you research. |
| Resend | Your email address and the emails we send you. | |
| Product analytics | PostHog | How the app is used, including session replays with page text, typed input and images hidden. Stored in the US. |
| Error reports | Sentry | App errors, cleaned of emails, phone numbers, links and form data. Stored in the US. |
| AI checks | TypeSafe | Text and screenshots our AI checks are asked to judge. |
| Blocked-site crawling | Cloudflare | Public pages of a site that blocks our own crawler. |
| Link data | Moz | The domains you audit. |
| Support | Our team's task board | The text of support requests you send us. |
Our privacy policy explains how we use personal data.
Report a problem
Found a security problem? Tell us first
Report a security problem
Email us with “Security” in the subject. Tell us what you found and how to see it. Please don't test against other customers' data.
hello@searchblueprint.ioQuestions buyers ask
Are you SOC 2 or ISO 27001 certified?
No. We don't hold either certification. This page lists the controls we have instead, each checked against our code.
Do you offer two-factor sign-in or single sign-on?
No. You sign in with a link sent to your email. A link works for 14 days and more than once, so keep your inbox secure.
Does all of my data stay in Singapore?
No. Our database and app servers are in Singapore. Payments, email, search and link data, error reports, AI models, product analytics and Google reports are handled by providers in other countries.
Is my data used to train AI models?
Anthropic, our main AI provider, does not train its models on data we send through its API. OpenAI and Google handle some tasks through their business APIs, under their own terms. We don't train AI models on your data.
Can your team see my workspace?
SearchBlueprint staff on a named list can open customer websites to give support. When one signs in as a customer from our admin page, we record who, whose account and when, and the session ends after 8 hours.
See what SearchBlueprint finds on your site
Start with a free plan for your site.
- Free first plan
- No credit card
- Keep your plan