Security

Infrastructure

The application runs on managed cloud infrastructure with isolated environments for development and production. Deployments are automated and versioned, so any change can be traced and rolled back.

Databases are managed, backed up daily, and restorable to a point in time.

Encryption

All traffic is served over TLS 1.2 or higher. Data at rest is encrypted using AES-256 by the underlying managed platform.

Secrets and API credentials are stored in an encrypted secret store and injected at runtime. They are never committed to source control or exposed to the browser.

Access control and tenant isolation

Every table holding customer data enforces row-level security, so a request can only ever read rows belonging to that account. Privileged operations run server-side after the caller's identity and role are verified.

Internal access to production is limited to the engineers who need it, protected by strong authentication, and reviewed regularly.

Payments

Subscriptions are handled by a PCI-DSS Level 1 payment processor. Card details are entered directly with the processor and never touch our servers; we store only customer and subscription identifiers.

Billing webhooks are signature-verified and processed idempotently.

Data handling during audits

Audits retrieve only publicly accessible pages, markup and marketplace listings. We do not attempt to access authenticated areas, and we respect standard crawl directives.

Assistant responses captured during a run are stored alongside your report so findings remain verifiable.

Availability and monitoring

Application and infrastructure logs are centrally collected, and errors are alerted to the engineering team. Backups are tested as part of routine restore checks.

Sub-processors

We use a limited set of vendors for hosting, database, email delivery, payments and AI model access. Each is contractually bound to appropriate confidentiality and security obligations. A current list is available on request via our data processing addendum.

Responsible disclosure

If you believe you have found a vulnerability, email security@rankable.ai with steps to reproduce. We acknowledge reports within two business days and will keep you updated until it is resolved.

Please do not run automated scans against production or access data that is not yours while testing. We will not pursue action against good-faith research that follows these guidelines.