Security. Short and honest.
Last updated 27 September 2026
What we collect, where it lives, and what we will never do with it, in plain sentences. Anything this page does not answer: security@ranksage.com.
What we collect, and what we never do.
Where the data lives, who can read it, and how to reach us about it.
Mainly your account email and the data you choose to connect. We don’t sell or share your data with marketers.
We cache it to make the product fast; the source of record stays in your own account. Disconnect or close your account and the cached copy is deleted. We never modify your source data.
Our primary database runs on Supabase in Singapore; the application runs on Railway and Vercel. Access is limited to authorized personnel on a need-to-know basis, protected with single sign-on and multi-factor authentication.
Encryption in transit and at rest, least-privilege access controls, and logging. We process every event — we don’t sample your data.
Content fetched from the open web — competitor pages, search results, scraped text — is treated as data, never as instructions: it is isolated behind an explicit trust boundary before any AI agent reads it, and additionally screened for injection-shaped anomalies, which are flagged rather than silently passed through. Agents never accept an identity or account from model input; every action is bound to the verified account server-side.
Yes. We use error tracking and performance monitoring so we can find and fix problems quickly. Error reports have personal details stripped before they leave our systems, any session recording masks all text, and performance data carries only pseudonymised account identifiers.
Both are self-service under Settings → Security. Export gives you a single file with everything tied to your account. Deletion is scheduled with a 14-day grace period so an accidental request can be cancelled; after that, everything tied to the account is erased.
No. Data sent to AI providers is only to generate outputs for you, under confidentiality and no-training terms.
No. If one ever affects you, we’ll notify you and the relevant authorities promptly and act to contain it.
Not yet — we’re a young product and may pursue certification as we grow. We’re happy to discuss security with larger customers.
Yes — our Data Processing Agreement, covering subprocessors, transfers, and security, is available on request.
Read-only by design.
RankSage reads Google Analytics and Search Console over read-only OAuth and never writes to them. Your source of record stays yours.
No payment details. One email when access opens.