Security. Short and honest.
Last updated 22 August 2026
What we collect, where it lives, and what we will never do with it, in plain sentences. Anything this page does not answer: security@ranksage.com.
What we collect, and what we never do.
Where the data lives, who can read it, and how to reach us about it.
Mainly your account email and the data you choose to connect. We don’t sell or share your data with marketers.
We cache it to make the product fast; the source of record stays in your own account. Disconnect or close your account and the cached copy is deleted. We never modify your source data.
On managed cloud infrastructure. Access is limited to authorized personnel on a need-to-know basis, protected with single sign-on and multi-factor authentication.
Encryption in transit and at rest, least-privilege access controls, and logging. We process every event — we don’t sample your data.
Content fetched from the open web — competitor pages, search results, scraped text — is treated as data, never as instructions: it is isolated behind an explicit trust boundary before any AI agent reads it, and additionally screened for injection-shaped anomalies, which are flagged rather than silently passed through. Agents never accept an identity or account from model input; every action is bound to the verified account server-side.
No. Data sent to AI providers is only to generate outputs for you, under confidentiality and no-training terms.
No. If one ever affects you, we’ll notify you and the relevant authorities promptly and act to contain it.
Not yet — we’re a young product and may pursue certification as we grow. We’re happy to discuss security with larger customers.
Yes — our Data Processing Agreement, covering subprocessors, transfers, and security, is available on request.
Read-only by design.
RankSage reads Google Analytics and Search Console over read-only OAuth and never writes to them. Your source of record stays yours.
No payment details. One email when access opens.