Security and data handling
RankUpside asks Google for read-only Search Console access, plus your basic profile and email. It can't change anything in Google. Google refresh tokens are stored encrypted, agent keys are stored hashed, and every request is checked against your workspace. You can revoke Google access, replace report links, revoke agent keys and delete clients at any time.
What it doesn't do: We hold no security certifications such as SOC 2 today, and we don't claim any. This page lists what the product actually does.
Updated
What RankUpside can see
One Google permission, read-only
View Search Console data for your verified sites
webmasters.readonly
- Clicks, impressions and positions by page and search, 13 weeks back
- Page titles, fetched from the client's public site
- No edits in Search Console or anywhere in Google
- No access to Gmail, Drive, Analytics or Ads
Revoke access any time at myaccount.google.com/permissions. Google tokens are stored encrypted.
What we can access in Google
Google sign-in asks for your basic profile, your email and one Search Console permission: View Search Console data for your verified sites (webmasters.readonly). It can read search performance, the list of properties and URL inspection results. It has no access to Gmail, Drive or Google Ads.
Business Profile access is a separate, optional sign-in (business.manage). It stays off until Google approves RankUpside's API access.
What we store
| Data | Why | How long |
|---|---|---|
| Account: your email, name and agency branding | Sign-in and the reports you send | Until you ask us to delete the account |
| Search Console rows for the sites you add: searches, pages, clicks, impressions, positions, URL inspection results | Trends, findings and reports | Weekly history older than about 70 weeks (about 16 months) is trimmed on each sync; removing a client deletes it |
| Google refresh tokens | The weekly sync | Encrypted with AES-256-GCM; until you disconnect or delete the account |
| Won deals and leads you send: dates, landing pages, sources, amounts, statuses, call durations | Revenue and leads by page | Until you remove the client |
| Lead phone numbers and emails | Matching a won deal to its lead | Only as salted SHA-256 hashes, plus the last two phone digits for display |
| Page titles and text from client pages with fixes | Writing fixes against what's on the page | Until you remove the client |
| Market data: search volume, cost per click, live results | Search value and live checks | Live results keep the last 12 checks per search; cached data for the workspace expires within 30 days |
Every request inside the app is checked against your workspace, so one agency can't read another's clients. More detail: Data and permissions.
Client reports
- Each report is a private link with a long random token. Anyone with the link can view that report, with no login.
- New link disables the old link right away.
- Reports and their PDFs tell search engines not to index them, and robots.txt keeps crawlers off report links.
- Reports show no contact hashes, phone digits or call-tracking provider names.
Agent keys
Agent keys are read-only and cover one client each. They're stored as hashes, limited to 60 requests a minute, and can be replaced or revoked any time in the client's settings. Requests from a browser on another website are rejected. See Connect an AI agent.
Webhooks and uploads
- Each client site has one webhook key, sent as a bearer token (or in the URL for call trackers that can only post to one) and stored as a hash. New key stops the old one at once.
- Webhook bodies aren't logged. No call recordings or transcripts are stored.
- Uploaded logos are checked by their file signature, not their name, and SVGs with scripts or event handlers are refused.
Our website
This website runs no advertising trackers and no third-party analytics script. Cookies cover your signed-in session, Google sign-in security checks, short status messages and interface preferences. Sign-in sessions last up to 30 days; signing out clears the session in that browser.
Revoke and delete
- Remove Google access from your Google account's third-party access page (myaccount.google.com/permissions). Syncing stops.
- Pause a client to stop its syncs and keep its data.
- Remove a client in its settings. Its Search Console rows, deals, leads, Business Profile metrics, findings and report link are deleted with it.
- Replace a report link with New link, or revoke an agent key, at any time.
- For account export or deletion, email hello@rankupside.com from the account's email address. Self-serve account deletion isn't built yet.
Where it runs
The app runs on Vercel, with its functions in the United States (San Francisco region, sfo1). The database is Supabase Postgres in the us-west-1 region. Everything travels over HTTPS.
Report a problem
Found a security issue? Email hello@rankupside.com with the details. A person reads it. The full policy is in the privacy policy and the terms of service; who runs RankUpside is on About.
Security questions.
Can RankUpside change anything in my Search Console?
How are Google tokens stored?
Who can see a client report?
Do you store caller phone numbers or emails?
Is client data used to train AI models?
How do I delete my data?
Is RankUpside SOC 2 certified?
Related
- DocsData and permissionsThe Google permission RankUpside asks for, what it stores per client, how long history is kept, how lead contacts are hashed, and how to delete it.
- DocsConnect Search ConsoleConnect Search Console with read-only access, add more Google accounts, find missing properties, and fix the "Search Console access wasn't granted" error.
- RankUpsidePrivacy PolicyHow RankUpside collects, uses, stores and shares account and Google Search Console data, plus your options for access and deletion.
- RankUpsideAboutRankUpside is SEO reporting software for agencies, built and operated by Verlua. Who builds it, what it's for, how it handles data and how to reach us.