Security
Built to protect your data by default.
DiscoveredBy is an internet-facing product, so security is the first consideration in every change, not an afterthought.
Access control
- Role-based access control is enforced on every API endpoint. Authentication alone is never enough.
- Strict tenant isolation: you can only ever read or change data in your own projects.
- Default-deny: if access isn’t explicitly granted, it’s refused.
Data protection
- All traffic is encrypted in transit over HTTPS.
- Google and WordPress credentials are encrypted before they are stored; sign-in links, API keys and share links are stored only as hashes.
- Session cookies are set http-only, secure, and same-site to guard against theft and CSRF.
- We never sell your data, and we don’t share it between accounts.
Infrastructure
- Hosted in Helsinki, Finland (European Union), with daily database backups kept for 7 days.
- Database queries use bound parameters, so values from a request are never run as SQL.
- Google integrations request least-privilege, read-only scopes for Search Console and Analytics.
- Request bodies and parameters are validated against a strict schema or parser before they’re processed.
Privacy
- Secrets, tokens, and full personal data are kept out of logs.
- Internal errors and stack traces are never leaked to clients.
- We collect only what’s needed to monitor your AI visibility.
Report a vulnerability
If you believe you have found a security issue in discoveredby.ai or the DiscoveredBy app, email hello@discoveredby.ai with "Security" in the subject line. Please report it privately to us rather than posting it publicly.
What to include
- The page, URL or API endpoint affected.
- The steps to reproduce the issue, with any request or screenshot that shows it.
- What you think an attacker could do with it.
- How we can reach you with follow-up questions.
While you look into it
- Use only your own account and projects. Do not open, change or delete data that belongs to anyone else.
- Do not run tests that slow down or disrupt the service for other customers.
- Give us a chance to fix the issue before you share details with anyone else.
The same contact details are published in machine-readable form at /.well-known/security.txt.
Questions about security?
Reach out any time at hello@discoveredby.ai. Our Data Processing Agreement and subprocessor list are public.
Start free