How we approach security.
Our security posture for this preview release. We describe what we do and avoid claiming certifications we do not hold.
Read-only by design
The audit engine inspects sites; it does not modify them. There is no mechanism for it to publish or change content on a site it audits.
Least-privilege access
When you connect Google Search Console, Daenah requests only the read-only Search Console scope. The current connection milestone uses the property list for selection and validation; it does not request Search Analytics performance data. Access can be removed locally or revoked at Google.
Token handling
Access and refresh tokens are treated as secrets and encrypted with authenticated encryption before server-side storage. Secret tables and OAuth attempt records are restricted to the server service role. Tokens are never sent to the browser, written into generated reports, or shared with third parties.
Bounded processing
Network fetches and downloads are bounded and fail closed rather than reading unbounded responses.
What we do not claim
We do not currently claim any formal security certification or compliance attestation (for example SOC 2 or ISO 27001). We will only state such things once they are independently verified.
Found a security issue? Email security@daenah.com.