What we protect, and how
SEOCells holds provider credentials on your behalf, which makes it worth being precise about how they are kept and what your data does.
You never handle an API key
Search and model access is configured once by a platform administrator and stored encrypted at rest. Keys are never displayed, never logged, never returned by the API, and masked to the last four characters wherever they must appear.
Keys cannot leak through an answer
Provider responses and error text pass through a scrubber before they can reach a page, a report or a run's files, so a provider error cannot carry a key into your workspace.
Tenant isolation is enforced by the database
Every tenant-owned row carries its workspace and row-level security is enforced in Postgres, not only in application code. A query that forgets its filter returns nothing rather than someone else's data.
Files are served through a containment check
Downloads resolve inside the workspace root and reject absolute paths, parent-directory segments and symlinks that escape it, so a run's files can never reach the server's filesystem.
Practices
| Credentials at rest | Encrypted with a rotating key set; the vault's own master key is separate and permission-restricted. |
| Session handling | Short-lived access tokens, rotating refresh tokens, httpOnly cookies, and no token stored in browser JavaScript. |
| Audit trail | Security- and money-relevant actions are recorded with actor, target and timestamp, in an append-only log. |
| Data residency | A workspace is pinned to a region at creation and its data stays there. |
| Reproducibility | Each run records the configuration and inputs it was given, so a result can be reproduced rather than merely trusted. |
| No auto-publish | There is no path from SEOCells to your live site. A person reviews and ships every change. |
Honest limits. SEOCells produces analysis and draft content. It does not guarantee a ranking, it does not publish, and its output is advisory — a person decides what ships. If something here matters to your procurement process, ask us for the specifics before you rely on them.