Security & Trust
Built to be trusted with your sites
SearchVoro connects to production systems and can apply changes on your behalf. That only works if security is the default — so credentials are encrypted, changes are approval-gated and reversible, and every action is logged.
Encryption everywhere
All traffic is served over TLS. Integration credentials and access tokens are encrypted at rest with AES-256-GCM and are never exposed back to the client. Databases and queues run on dedicated infrastructure that is not exposed to the internet.
Least-privilege access
Access to production systems is role-based and least-privilege. Sensitive administrative surfaces are restricted to platform staff, and every privileged action is recorded in an audit log.
Tenant isolation
Every account's data is isolated. Requests are scoped to the caller's account and ownership is checked on each record; in production, an unresolved tenant context fails closed rather than falling back to broad access.
Safe automation by design
Autonomous changes are off by default and require explicit approval. Approved WordPress title and description fixes are read back and verified, and a mismatch is automatically rolled back — with a complete, reviewable audit trail.
Controls
How the platform protects you
The specific controls behind the four principles above.
| Authentication | Sessions use signed bearer tokens; the server-side session record is the source of truth for expiry and revocation. Users can review their active sessions and revoke another device. Authenticator-app MFA includes replay protection and ten one-time recovery codes shown only at enrollment; only keyed hashes are stored. Customer SSO is not currently a self-serve feature, so enterprise identity requirements must be included in the signed order form. |
|---|---|
| CMS connections | You connect WordPress or Shopify explicitly and can disconnect at any time, which revokes SearchVoro's stored access. Connections are used only to perform the actions you authorize. |
| Change safety | Approved WordPress title and description fixes are applied, immediately read back, and confirmed; if the live value doesn't match what was written, the change is rolled back automatically. Manual applies in SearchVoro Pro record the prior value, with one-click verify and rollback. |
| Backups & recovery | PostgreSQL is exported once daily. Backup files are retained for 7 days on replicated persistent storage. The standard-service recovery point can therefore be up to 24 hours; no contractual recovery-time objective applies unless an Enterprise order form states one. |
| Infrastructure | SearchVoro runs on an RKE2 Kubernetes cluster hosted by LeaseWeb Netherlands B.V. in the Amsterdam region. PostgreSQL, Redis, and RabbitMQ are not exposed publicly; Redis and RabbitMQ are additionally restricted by Kubernetes NetworkPolicy. Public traffic passes through Cloudflare edge protection to nginx ingress, with certificates managed by cert-manager. The public subprocessor register identifies the operator and general processing region. |
| Audit records | Administrative and product mutations are recorded with actor and target context. Audit records are not assigned a shorter retention window by pricing tier; account deletion and legal-retention requirements govern removal. |
| Secure development | Changes pass formatting, lint, type, unit, integration, build, and production-dependency audit gates before deployable images are published. Production dependency findings at moderate severity or higher block CI unless a documented exception is configured. |
| Vulnerability assurance | Dependency auditing is automated. Every immutable release image is also scanned after build for fixed high and critical OS and application-package vulnerabilities; a finding fails release eligibility before deployment. Independent penetration testing is not currently represented as complete and remains on the enterprise security roadmap. |
| Staff access & secrets | Production access is role-based and least-privilege, and secret values are not committed to the repository. Access-review and secret-rotation workflows exist in the platform, but no fixed public review or rotation cadence is claimed today. |
| Incident response | Reports are triaged, contained, investigated, remediated, and reviewed. Affected customers are notified without undue delay when required by applicable law or contract. The public status page reports live first-party availability checks; it is not an independent monitor and does not yet provide historical uptime or an incident archive. Material incidents are also communicated directly. |
| Business continuity | Public web workloads run with multiple replicas, data volumes are replicated, and daily database exports provide a restore point. These controls support recovery but do not create a contractual RTO or availability SLA outside a signed Enterprise agreement. |
| Compliance | SearchVoro does not claim SOC 2, ISO 27001, HIPAA, or PCI certification. A DPA and security questionnaire are available for buyer review, and future certifications will be listed only after they are obtained. |
| Data ownership | You own your data and connected properties. We never sell personal information and never use your content or connected-property data to train our own models. |
Compliance & data processing
Data processing and subprocessors
We keep a current register of the third parties that process data on our behalf, and we support the paperwork enterprise buyers need.
Our up-to-date list of subprocessors — cloud hosting, AI providers, and supporting services — is published on our subprocessor register. Our Data Processing Addendum is published in full; email [email protected] for a countersigned copy or answers to a security questionnaire.
FAQ
Frequently asked questions
- How are my WordPress or Shopify credentials stored?
- Access tokens and credentials for systems you connect are encrypted at rest with AES-256-GCM and used only to perform the actions you authorize. They are never returned to the browser, and disconnecting an integration revokes SearchVoro's access.
- Can SearchVoro change my site without my approval?
- No. Autonomous changes are disabled by default. Nothing is written to a connected CMS unless you enable it and approve the change, and approved WordPress fixes are verified and rolled back on mismatch.
- Is my data isolated from other customers?
- Yes. Data is scoped per account and ownership is enforced on every record. In production, an unresolved tenant context fails closed rather than granting access.
- Do you use my content to train AI models?
- No. We do not use your content or connected-property data to train our own models. Where features use third-party AI providers, content is processed under those providers' API terms solely to deliver the feature you requested.
- Can I get a DPA or a list of subprocessors?
- Yes. Both our subprocessor register and our Data Processing Addendum (DPA) are published in full on the Subprocessors and DPA pages, linked from the footer and the "Data processing" section above. Contact [email protected] for a countersigned copy of the DPA or answers to a security questionnaire.
- How do I report a security issue?
- Email [email protected] with the details. We investigate reports promptly and will keep you updated on remediation.
Have a security question?
Review our published subprocessor register and Data Processing Addendum, or email [email protected] for a countersigned copy and security questionnaire.