Security & data handling
Your clients trust you. You can trust this.
Agencies hold other companies' data. Here is exactly how Elite Answers keeps it separated, scoped and short-lived — in plain language, without badges we haven't earned.
01Access & accounts
Access & accounts
- Organisation isolation
- Every request resolves the active organisation from the signed-in session, and every query is scoped to it. One agency can never read another's workspaces.
- Roles
- Owner, admin, member and client viewer. Client viewers see only the workspaces explicitly granted to them — not your other clients, billing or team.
- Sign-in
- Google sign-in, email and password with verification, and one-time magic links. Passwords are salted and hashed; we never store them in plain text.
- Rate limiting
- Sign-in, sign-up, password reset and magic-link endpoints are rate-limited in production.
02Sharing & API
Sharing & API
- Share links
- Client report links use 32-character random tokens. You can set an expiry or disable a link at any time; disabled links return 404.
- Frozen reports
- A shared report contains a snapshot of the reporting period, not live access to the workspace.
- API keys
- Keys are shown once, stored only as SHA-256 hashes, scoped to your organisation, and revocable instantly.
03Data handling
Data handling
- What we store
- Your prompts, brand and competitor names, the answers engines return, their citations, and audit results for the sites you choose to audit. We don't need your clients' customer data — and we don't ask for it.
- Retention
- Answer history is kept for your plan's retention window and deleted on a daily schedule after that. Deleting a workspace deletes its data.
- Payments
- Billing runs on Stripe. Card numbers never touch our servers; we store a customer ID and subscription status.
- Outbound requests
- Site audits refuse private, loopback and cloud-metadata addresses, and re-check every redirect, so a submitted URL can't be used to probe internal networks.
04Infrastructure & vendors
Infrastructure & vendors
- In transit
- All traffic is served over HTTPS. Security headers (nosniff, frame and referrer policies) are set on every response.
- Sub-processors
- We use providers for hosting and databases, email delivery, payments, authentication and AI answer collection. Our DPA describes how they are engaged and how we notify you of changes.
- Engine queries
- Questions sent to answer engines contain your tracked prompts — public-style buyer questions — not personal data.
Running a security review?
Read our DPA and privacy policy, or send your questionnaire to [email protected].