Security
How Publinza protects your account, your projects and your data.
Accounts and sign-in
- Every page is served over HTTPS, and browsers are told to use HTTPS only.
- Passwords must be at least 12 characters and are stored only as one-way hashes.
- Repeated sign-in, sign-up and password-reset attempts are slowed down.
- Resetting a password signs the account out everywhere else.
Who can see what
- An SEO project is visible only to its owner and the people they add, in the role they are given.
- Organization members see what their role allows; a client viewer sees only the published reports of their own projects.
- Shared report links are long random tokens, expire, and can be revoked at any time.
- Publishers and advertisers in the marketplace see only what an order needs; neither sees the other's SEO projects.
Connections and payments
- Google connection tokens are encrypted before they are stored.
- Payments are taken on the payment provider's own hosted pages. Publinza never sees or stores a card number.
- Payment and billing webhooks are accepted only with a valid signature from the provider.
The crawler
- It reads at most 50 pages per audit and follows robots.txt.
- It never connects to a private or internal network address, whatever a page or a redirect points it at.
- It only reads pages: it never submits a form or signs in anywhere.
Backups and operations
- Backups are encrypted, and every backup is restored into an isolated database and checked before it is kept.
- Administrative changes to billing and support actions taken on a customer's behalf are recorded with who made them and why.
- When something goes wrong unexpectedly, the error page shows no internal details - only a reference our support can look up.
Your data, your choice
The Privacy Policy explains what is collected and why, and Data deletion explains how to have it removed.
Found a security problem? Please tell us through support and describe what you saw. Please do not test against other people's accounts or data.