Security

Where Ranktide runs

The website and the app run on Cloudflare Workers. Ranktide's databases, stored files and background jobs use Cloudflare's storage and Workflows. We don't run servers of our own.

Encryption

• Every connection to ranktide.io and app.ranktide.io uses HTTPS (TLS). Our calls to providers such as Stripe, Google and DataForSEO use TLS too.
• Cloudflare encrypts Ranktide's stored data at rest.
• Credentials you connect get a second layer of encryption from Ranktide itself, described below.

Credentials you connect

• Google. Search Console and Analytics use read-only scopes, so Ranktide can't change anything in your Google account. The access tokens are encrypted before they are stored. Disconnecting in Ranktide deletes them once no project uses them.
• Your own DataForSEO key. Encrypted before it is stored and used only for your organisation's requests. After you save it, Ranktide shows only a masked version of the login, never the full key.
• Ranktide API keys. Stored as hashes. You see a key once, when you create it. After that, Settings shows only its first few characters.
• Crawler access for your store. Saved crawler signatures are encrypted with a separate key that only the audit service holds.
• Passwords. Stored as hashes, never in readable form.

Payments

Stripe handles all card payments. Card details go straight to Stripe, and Ranktide never stores card numbers.

Accounts and access

• Each organisation has an owner, and can have admins and members. Owners and admins manage members, billing and settings. Every request for project data is checked against the organisation the project belongs to.
• New accounts verify their email address. Sign-up runs a Cloudflare Turnstile bot check, and sign-in attempts are rate-limited.
• Password reset links expire after an hour. Resetting your password signs out your other sessions. Sessions expire after 7 days without use.
• You can revoke API keys, AI assistant connections and report share links at any time.
• Access to production systems is limited to the people who run Ranktide, and only to operate and support the service.

Deleting your data

You can delete your account from Settings. After a 14-day waiting period, we erase your data from Ranktide and from our analytics, email and billing providers, and revoke our Google access. The privacy policy has the details, and the subprocessors page lists every provider that handles personal data for us.

Our crawler

Site audits use a crawler that names itself in its user agent, follows robots.txt and sends about one request per second. Requests from the app are signed with Web Bot Auth so site owners can check they are real. The crawler page explains how to allow or block it.

What we don't do

• We don't sell your data.
• We don't use your data or your Google data for advertising or to train AI models.
• We don't ask for write access to your Google accounts.
• We don't store card numbers.

Reporting a vulnerability

If you find a security problem in Ranktide, email security@ranktide.io. Please don't report it in public until we have fixed it.

Include:

• the affected URL, API endpoint or MCP tool;
• the steps or requests that reproduce it;
• what you were able to read, change or spend;
• the account and organisation you tested with.

Testing guidelines

• Use only accounts and data you own. Create test accounts for this.
• Don't access, change or delete other customers' data. If you reach someone else's data by accident, stop, don't keep it, and tell us.
• Don't degrade the service: no denial-of-service attacks, load tests or spam.
• Don't spend credits you didn't pay for or use up the free tools' daily limits.
• No social engineering or phishing of our team or customers.

Out of scope: problems in third-party services we use (report those to the vendor), and reports that only point out a missing rate limit.

What to expect

• We reply within a few business days.
• We keep you updated and tell you when the fix is live.
• We don't run a paid bug bounty program.

Safe harbour

If you act in good faith and follow these guidelines, MASDE Agency will treat your research as authorised. We won't take legal action against you for it or ask anyone else to.

Questions

For security questions or a security questionnaire, email security@ranktide.io.