Not sure where to start? Take a guided tour.
AI Site Grader
AI Query Scanner
llms.txt GeneratorYour security review,
answered.
Where your data lives, who can reach it and who else sees it. Plain answers to what your security team will ask.
trakkr.ai/security- 01Where does our data live, and how is it protected?Google Cloud in the US, and Supabase. Encrypted in transit and at rest.
- 02Who can reach it?The people you invite, brand by brand, with SAML SSO and two-factor.
- 03What can connected tools read?Google connections are read-only. Site changes need your approval.
- 04Who else processes it?Named infrastructure providers. The full list is yours on request.
- 05How long is it kept?While your account is open. Personal data goes within 30 days of closing it.
- 06Who do we talk to?[email protected], for a DPA, your questionnaire or a security report.
Where does our data live, and how is it protected?
Google Cloud Run runs the app and jobs in the United States, and Supabase stores data and handles sign-in. Encrypted on the way in and at rest, with site credentials encrypted again by us.
Where it runs
us-east1, United States
Contact us for residency details
Global edge delivery
How it’s protected
Encrypted browser and API traffic
Stored database data, as our privacy policy sets out
Connected site credentials, encrypted by us before storage
How it’s kept apart
Each brand’s data is keyed to it, and access is checked on every brand request
Error reporting runs with default personal data switched off
We do not store your full card number
Who can reach it?
At your company, only the people you invite, brand by brand. At Trakkr, only named staff can access production systems.
- SAML single sign-on, plus Google and email
- Owners can require two-factor for everyone
- Logs of sign-ins, invites and role changes
Who can reach nike.com’s data| Who | See it | Change it | Invite |
|---|---|---|---|
| OwnerBilling, seats and team two-factor | Can | Can | Can |
| AdminsEdit their brands, invite people | Can | Can | Can |
| ViewersRead-only | Can | Can’t | Can’t |
| Client portal usersShared brands only, view only | Can | Can’t | Can’t |
| The AgentChanges only what you confirm | Can | Only after you confirm | Can’t |
What can connected tools read?
Only what each job needs. Google connections are read-only, and the scopes below are the ones each tool shows you when you connect it.
Trakkr canRead clicks, queries and pages for your sites
Trakkr can’tChange a setting, submit a sitemap or add a user
webmasters.readonly
Trakkr canRead reports for the property you pick
Trakkr can’tWrite events back or change property settings
analytics.readonly
Trakkr canEdit the pages and articles your team approves
Trakkr can’tSee orders, customers or payments
write_content, read_products
Trakkr canOpen a pull request on the repo and branch you pick
Trakkr can’tMerge it. Your team reviews and merges.
Trakkr canSend the outreach emails you write and choose to send
Trakkr can’tRead, search or download your inbox
gmail.sendWho else processes it?
A short list of companies, each with one job. AI providers get the prompts and brand details your analysis needs, never your password or card.
| Company | What for |
|---|---|
| Google Cloud | App hosting and file storage |
| Supabase | Database and sign-in |
| Cloudflare | Website and edge delivery |
| Stripe | Payments |
| AI models | The AI platforms we track and the models behind your analysis, such as OpenAI, Anthropic and Google |
How long is it kept?
For as long as you are a customer. Close your account and we delete your personal information within 30 days, subject to the exceptions in our privacy policy.
- While your account is open
Kept, and yours to take
Export supported reports, or ask for a copy of your personal information.
- The day you close it
Closed when you say
Use account settings, or email [email protected] and we will do it for you.
- Within 30 days
Personal data deleted
We delete your personal information, as our privacy policy sets out.
- Only as long as the law needs
A few records stay
Transaction records for accounting, security logs, and anything the law requires.
Who do we talk to?
A DPA or your questionnaire
Need a DPA or a security questionnaire filled in? Email us the documents and requirements your team needs.
Request documentsFound a problem? Tell us
Email the affected page and steps to reproduce it. We look into every report and keep you updated. Please give us a chance to fix it before sharing it publicly.
Report a problemBring your questions to a call
Book a demo and we will walk your team through roles, sign-in and connections.
Book a demoQuestions,
answered.
The ones security teams ask most. Anything else, just ask.
Yes. SAML single sign-on is live, alongside Google and email sign-in. Owners can also require two-factor for everyone on the team, with codes sent by email.
The Agent answers from our docs, methods and pricing, and links to the source.
Bring your
security team.
Book a call and we will take them through every answer on this page.
Need a DPA or security questionnaire? Email [email protected].