Security overview

    Security written for SEO data — competitive, opinionated, and worth defending.

    This page describes the technical controls and operational practices LemRank uses to protect your projects, keywords, rankings, and reports. It is updated whenever a control changes.

    Technical controls

    The eight controls every account inherits.

    Encryption in transit

    All client → server traffic uses TLS 1.2+. Internal service-to-service hops inside the EU region run over an encrypted private network.

    Encryption at rest

    Primary Postgres, object storage, and managed backups are AES-256 encrypted at rest by the underlying cloud provider.

    Row-Level Security on every customer table

    Every table holding customer data is gated by RLS policies scoped to auth.uid() or the user's account. Service-role access is reserved for audited edge functions.

    Multi-factor authentication

    TOTP-based 2FA is available to every account, plus single-use recovery codes for lost devices. SSO via Google is built-in; SAML SSO is available on enterprise plans.

    Least-privilege role separation

    anon, authenticated, and service_role are granted distinct privileges. New tables ship with grants narrowed to the policies they expose — no blanket access.

    Network isolation

    The database is not publicly reachable. All writes flow through the API or through signed edge functions with input validation and rate limiting.

    EU hosting

    Primary database and edge functions run in Frankfurt (eu-central-1). Backups are kept in the same region.

    Audit logging

    Authentication events, admin actions, and security-relevant edge function calls are logged and retained for at least 90 days.

    Operational practices

    How we ship without breaking your data.

    • Backups
      Daily automated backups with point-in-time recovery for the most recent 7 days.
    • Dependency hygiene
      Continuous npm audit on every PR; high-severity CVEs block merge until patched.
    • Secrets management
      Application secrets stored in the platform vault — never in source, never in client bundles.
    • Code review
      Every change is reviewed before reaching production. Direct pushes to main are disabled.
    • Pen-testing
      Annual external penetration test plus continuous automated security scanning between tests.
    • Vulnerability disclosure
      Public disclosure policy with a 1-business-day acknowledgement SLA — see /security/disclosure.

    Incident response

    We follow a documented playbook for security incidents. The summary:

    1. Detection — automated alerts on auth anomalies, error spikes, and infrastructure health.
    2. Containment — affected credentials are rotated and impacted surfaces are isolated.
    3. Investigation — timeline and scope assembled from audit logs.
    4. Notification — material incidents are reported to affected customers within 72 hours of confirmation.
    5. Post-mortem — every Sev-1/Sev-2 incident produces a written, blameless post-mortem published to enterprise customers on request.

    Found something? Report it via the responsible disclosure policy or email security@lemrank.com.