Security
How your data is handled, without the badge wall
This page describes controls that exist in the product today. Where a control does not exist, it is not listed — and where we hold no certification, we say so rather than leaving you to assume.
Your prompts and responses are your data
We store what we measured so findings stay auditable — a finding you cannot open is just an assertion. We are specific below about what we hold, what leaves our systems to reach a model provider, and what we have not done yet.
Sessions your browser cannot leak
Most token theft in single-page applications comes down to one decision: whether a token was ever put somewhere JavaScript could read it. Ours is not.
Zitadel OIDC, through a backend-for-frontend
Sign-in runs against Zitadel over OIDC. The token exchange happens server-side in a backend-for-frontend, so access and refresh tokens are handled by the API and never handed to your browser.
httpOnly session cookies, not localStorage
The browser holds an httpOnly, SameSite=Lax session cookie and nothing else. It is not readable from JavaScript, which takes the single most common token-theft path — a token sitting in localStorage — off the table entirely.
Encrypted transport
Traffic to the application and the API is served over TLS, and session cookies are issued with the Secure flag in every deployed environment.
Who can reach what, and what gets recorded
Isolation and roles are enforced in the API. A control that only hides a button in the interface is not a control.
Workspace and brand isolation
Your brands, prompts, competitors, runs and responses belong to your workspace. Access is resolved per workspace on request, and an agency reaching a client workspace does so through an explicit link rather than an implicit one.
Role-based access
Membership maps to a data role. Administrators get write access; everyone else is read-only by default, and the write check is enforced by the API rather than by hiding a button in the interface.
API keys you can revoke
Keys are generated with a tg_ prefix and stored only as a SHA-256 hash, so the plaintext key exists once — at the moment you create it. Any key can be revoked, and a revoked key stops working immediately.
Audit logging on administrative actions
Administrative actions are written to an audit log recording who acted, what they did, which object they touched, the originating IP address, and when. It is append-only from the application's point of view.
Agencies working across multiple clients get one workspace per client, each with its own brands, prompts and competitors, reached through an explicit link between workspaces.
What we hold, and what leaves
Measuring what a model says about you requires sending it a question. That is the one place your data leaves our systems, so it deserves a plain description rather than a footnote.
What we store
The prompts you configure, the responses returned, the sources cited, and the scores computed from them. We keep the response because it is the evidence behind the finding — without it, every number on your dashboard would be something you simply had to believe.
What we send to providers
Your prompts go to the model providers listed on our engines page, because asking them is the only way to measure what they answer. Each provider handles that request under its own API terms. Nothing you store in TrackGeo is used to train a model.
See which providersYour rights over it
Data rights, including access, export and deletion, are set out in our privacy policy together with how to exercise them. For a specific compliance question, ask us directly and you will get a direct answer.
Read the privacy policyWe do not hold any security certifications
Not SOC 2. Not ISO 27001. Not HIPAA. None have been obtained, and none are implied anywhere else on this site. We would rather lose a procurement checkbox than let you discover this in week three of an evaluation.
The controls described on this page are real, implemented, and ours to be held to — but they have not been audited by a third party, and an unaudited control is a promise rather than an attestation. If certification is a hard requirement for you, say so early and we will tell you plainly where we stand instead of running you through a process that cannot end well.
Working through a security questionnaire? Send it over and we will answer it as it is written.
Contact usSecurity, answered plainly
Is TrackGeo SOC 2 or ISO 27001 certified?
No. TrackGeo holds no security certifications today — not SOC 2, not ISO 27001, not HIPAA — and we will not imply otherwise. The controls described on this page are real and you can hold us to them, but none of them have been audited by a third party. If a certification is a hard requirement for your procurement process, tell us before you invest time in an evaluation.
Where are my authentication tokens stored?
Not in your browser. Sign-in runs through Zitadel over OIDC, and the token exchange happens server-side in a backend-for-frontend. Your browser holds an httpOnly, SameSite=Lax session cookie that JavaScript cannot read. Access and refresh tokens stay on the server side.
What happens to my prompts and the responses you collect?
Prompts are sent to the model providers listed on our engines page, because running them is the only way to measure what those models answer. The responses come back and are stored in your workspace, along with the sources cited, so that every finding can be opened and checked rather than taken on trust. They are your workspace's data and are not used to train models.
Can I control who on my team can change things?
Yes. Membership maps to a data role: administrators can write, and everyone else is read-only by default. The check is enforced in the API, not by hiding controls in the interface, so a read-only member cannot write by calling the endpoint directly.
How do I delete my data?
Data rights, including deletion and export, are covered in our privacy policy along with how to exercise them. If you need something specific for a compliance review or a security questionnaire, contact us and we will answer directly rather than pointing you at a badge.
Ask us the awkward questions
We would rather have the hard conversation before you buy than discover a mismatch afterwards.