Security and privacy

FixAEO’s security surface is small on purpose: one Go API, one Postgres database, and a published list of the third parties that touch your data. This page collects what a security review usually asks for. It links the real documents and states the gaps plainly, so you can decide early instead of mid-trial.

​

What FixAEO doesn’t have

Start here. It saves you a call.

• No SOC 2. No Type 1, no Type 2, no audit underway.
• No ISO 27001.
• No contractual SLA. There’s no uptime commitment and no service credits.
• No SSO or SCIM. Sign-in is per user, by magic link or OAuth.
• No published uptime history. The status page checks live health only.
• No paid bug bounty. Reports still get answered — see below.

​

Where does your data live?

One place. Your account data, brands, prompts, and scan history sit in a single Postgres database on Oracle Cloud Infrastructure, in the Mumbai region in India. That matters if you’re in the EU or the UK. Your data leaves the EEA. The Data Processing Addendum covers those transfers using the EU Standard Contractual Clauses and the UK Addendum. Cloudflare sits in front of the marketing site for CDN, DNS, and DDoS protection. The API is a separate origin at api.fixaeo.com.

​

Subprocessors

Fifteen third parties are listed at fixaeo.com/subprocessors, each with its purpose, the data it receives, and its processing region. The list was last updated on 25 May 2026. It covers the categories a reviewer expects: hosting, CDN, payments, transactional email, product analytics, OAuth providers, and the AI vendors FixAEO holds an API account with — Anthropic, OpenAI, Google, xAI, DeepSeek, plus SerpAPI for AI Overviews coverage. New subprocessors get published before they go live, not after. If you object to one and it’s essential to the service, your only real remedy is to close your account.

​

How are payments handled?

Lemon Squeezy is the merchant of record, so card numbers never touch FixAEO systems. Lemon Squeezy (a Stripe company) handles the card details, the recurring charge, and sales tax or VAT. What FixAEO stores is a billing record: your email, the amount, the currency, and the charge date. No card number, no CVV, no expiry.

​

Signing in

There are no passwords anywhere in FixAEO. No password column, no reset flow, nothing to leak. You sign in one of two ways:

• Magic link. A one-time link emailed to you, valid for 15 minutes.
• OAuth. Google or Microsoft.

You can turn on TOTP two-factor in Settings. It works with any authenticator app and issues one-time recovery codes, shown once at setup. With it on, a fresh sign-in lands on a challenge screen before the app opens. The session cookie is HttpOnly, SameSite=Lax, and Secure outside localhost. Sessions last 30 days. Settings lists your active sessions so you can revoke them.

​

What’s encrypted?

Everything in transit runs over TLS. At rest, FixAEO applies AES-256-GCM at the application layer to the credentials that would do the most damage if a database dump leaked:

• Your Google Analytics refresh token
• Your Search Console refresh token
• Your WordPress application password

API keys for the public API aren’t stored at all. Only a SHA-256 hash is kept, and the plaintext key is shown once at creation. If you lose it, you rotate it. Visitor IP addresses collected by Agent analytics are hashed with a salted SHA-256 before they’re written. The raw address isn’t stored.

​

What reaches the AI providers

Every scan sends your prompts to AI engines the way a buyer would ask them. The prompt carries your brand context, such as “best CRM for early-stage startups.” No user identifiers go out with it, so the provider sees the question and FixAEO’s own credentials, and nothing that ties the query back to you. Providers differ on whether they retain prompts for training. The subprocessor page links each provider’s own policy, which is the authoritative source.

​

Can FixAEO staff see your dashboard?

Yes, read-only, and it’s gated. There’s an operator view that renders the same data your dashboard reads, straight from the database. No customer session is created and no write path exists. Every query is a SELECT. It sits behind HTTP Basic Auth on a single shared operator credential, compared in constant time against a salted SHA-256 hash. Anyone without it gets a 401. Each brand view writes a server log line with the brand ID, the client IP, and the user agent. Because the credential is shared, that line records an operator rather than which one. That’s the honest granularity a shared credential allows, and it’s worth knowing before you decide the audit trail meets your bar. FixAEO never signs in as you. Full identity assumption would expose billing, email, and settings, so it isn’t built.

​

Reporting a vulnerability

There’s an RFC 9116 file at fixaeo.com/.well-known/security.txt. Reports go to security@fixaeo.com. The stated target is a response to verified reports within five business days, with coordinated disclosure on a reasonable timeline. There’s no paid bounty. Researchers get credited with their permission. In scope: fixaeo.com and its subdomains, the public scan API, and the authenticated app. Out of scope: denial-of-service against AI provider quotas, social engineering of customers, physical or wireless attacks, and stale information inside cached AI answers. That last one is the thing FixAEO measures, not FixAEO’s infrastructure.

​

Uptime and status

fixaeo.com/status polls api.fixaeo.com/health every 30 seconds and reports one of three states. Operational means a 200 within two seconds. Degraded means it responded but took longer. Down means an error or no response within ten seconds. There’s no 30-day uptime chart, because there’s no historical pinger behind it. The page says so rather than showing a number it can’t stand behind.

​

Getting a DPA

FixAEO is GDPR-aligned, with a DPA available on request. It isn’t certified against any standard, and this page won’t claim otherwise. The addendum is published at fixaeo.com/dpa. It sets the roles clearly:

• For your account data, FixAEO is the controller.
• For visitor data collected by the analytics tag — hashed IP, user agent, referrer, page path — you’re the controller and FixAEO is the processor.

For most customers, accepting the Terms brings the DPA into effect. If procurement needs a counter-signed copy, email hello@fixaeo.com. The privacy policy at fixaeo.com/privacy covers the GDPR and CCPA/CPRA rights. FixAEO doesn’t sell or share personal information as those terms are defined under the CCPA.

​

Data retention

FixAEO doesn’t publish a retention window in days, and this page won’t invent one. What the privacy policy commits to: account, product, and billing data is kept while your account is active. Deleting your account removes your personal data, except records that must be retained for legal or tax reasons, such as invoices, and routine backups that age out on a rolling schedule. Hashed IPs used for rate limiting are short-lived. One product surface does have fixed windows, because they’re a storage decision rather than a policy: raw crawler hits are pruned at about 60 days and the daily rollups behind the charts at about 400. See Agent analytics.

​

Exporting and deleting your data

Both are self-serve, under Settings → Privacy & data. No support ticket, no waiting period. Download my data returns a JSON file for GDPR Article 20 portability. It carries your profile and your billing history. Your brands, prompts, and measurements come out through the CSV exports instead — Export your data has the detail on each one. Delete account is Article 17 erasure. You type your own email address to confirm. The delete cascades through sessions, OAuth identities, brands, snapshots, mentions, prompts, alerts, integrations, and API keys. All sessions are revoked and the cookie is cleared. It can’t be undone.

​

Related