You're handing us Search Console access. Here's what protects it.
This page describes what's actually true today, not what we aspire to — no vague "bank-level encryption" claims. For the full detail on what we collect and who it's shared with, see the Privacy Policy.
Read-only, always
We request Search Console's read-only scope. There is no code path in tranck that can write to, or change anything in, your Search Console account.
Encrypted at rest
The Google credential that gives us ongoing access is encrypted with AES-256-GCM before it's ever written to disk — not stored as plain text.
No passwords to steal
Sign-in is Google OAuth only. tranck has never had a password database, so there's nothing there for a breach to expose.
Isolated per account
Every query behind every page is scoped to the signed-in account. We audited this specifically — one customer's data is never reachable from another's session.
Your data, your exit
Disconnect any property instantly from Sites, or delete your entire account and everything under it from Settings — both permanent, both self-service, no ticket required.
Actually monitored
Unattended jobs (daily syncs, weekly summaries) page us directly if they fail outright or fail for an unusual share of accounts — not something we find out from a support email.
Application security
- All traffic is served over HTTPS, with HSTS enforced.
- A Content-Security-Policy, X-Frame-Options, and standard hardening headers are set on every response.
- Sessions are stored server-side and are revocable — we don't rely on a long-lived token sitting in your browser to keep you signed in.
- Every page is built with React, which escapes rendered content by default — the standard defense against injecting malicious markup into a page.
Payments
Stripe handles checkout and stores your payment details directly. tranck never receives or stores your card number — we only ever see your subscription status and plan.
Infrastructure
tranck runs on Vercel, with Postgres hosted on Neon. Both are established infrastructure providers we don't operate ourselves, which means the physical and network security of the underlying servers is their job, not ours to reinvent.
Found a problem?
If you find a security issue, we'd genuinely rather hear about it from you, privately, before anyone else finds it — privacy@tranck.com. We'll respond, and we won't go quiet on you.