Security overview

Security written for SEO data — competitive, opinionated, and worth defending.

This page describes the technical controls and operational practices LemRank uses to protect your projects, keywords, rankings, and reports. It is updated whenever a control changes.

Technical controls

The eight controls every account inherits.

Encryption in transit

All client → server traffic uses TLS 1.2+. Internal service-to-service hops inside the EU region run over an encrypted private network.

Encryption at rest

Primary Postgres, object storage, and managed backups are AES-256 encrypted at rest by the underlying cloud provider.

Row-Level Security on every customer table

Every table holding customer data is gated by RLS policies scoped to auth.uid() or the user's account. Service-role access is reserved for audited edge functions.

Multi-factor authentication

TOTP-based 2FA is available to every account, plus single-use recovery codes for lost devices. SSO via Google is built-in; SAML SSO is available on enterprise plans.

Least-privilege role separation

anon, authenticated, and service_role are granted distinct privileges. New tables ship with grants narrowed to the policies they expose — no blanket access.

Network isolation

The database is not publicly reachable. All writes flow through the API or through signed edge functions with input validation and rate limiting.

EU hosting

Primary database and edge functions run in Frankfurt (eu-central-1). Backups are kept in the same region.

Audit logging

Authentication events, admin actions, and security-relevant edge function calls are logged and retained for at least 90 days.

Operational practices

How we ship without breaking your data.

Backups
Daily automated backups with point-in-time recovery for the most recent 7 days.
Dependency hygiene
Continuous npm audit on every PR; high-severity CVEs block merge until patched.
Secrets management
Application secrets stored in the platform vault — never in source, never in client bundles.
Code review
Every change is reviewed before reaching production. Direct pushes to main are disabled.
Pen-testing
Annual external penetration test plus continuous automated security scanning between tests.
Vulnerability disclosure
Public disclosure policy with a 1-business-day acknowledgement SLA — see /security/disclosure.

Incident response

We follow a documented playbook for security incidents. The summary:

Detection — automated alerts on auth anomalies, error spikes, and infrastructure health.
Containment — affected credentials are rotated and impacted surfaces are isolated.
Investigation — timeline and scope assembled from audit logs.
Notification — material incidents are reported to affected customers within 72 hours of confirmation.
Post-mortem — every Sev-1/Sev-2 incident produces a written, blameless post-mortem published to enterprise customers on request.

Found something? Report it via the responsible disclosure policy or email security@lemrank.com.