Security

Ranksify runs on dedicated servers with a managed edge in front of the application domain. Postgres is the only system of record; Redis holds transient job and rate-limit state and is never the sole home of customer data.

Everything runs on dedicated Hetzner servers in Falkenstein, Germany — inside the European Union, which is what our privacy policy's international-transfer section rests on. Cloudflare provides DNS and the edge in front of the domain.

All traffic is served over HTTPS with HSTS. Third-party credentials — the OAuth tokens for Google Search Console, Google Analytics and Bing Webmaster Tools, and any API keys you supply — are encrypted at rest with AES-256-GCM under a key held outside the database, and are redacted from every API response the browser can reach.

Passwords are salted and hashed; we never store or transmit them in a recoverable form. Google sign-in is supported. Inside a workspace, every member holds a role, and both the API routes and the database queries check it — permissions are enforced on the server, not hidden in the interface.

The application enforces a nonce-based Content Security Policy with no external script origins allowed, sends HSTS, denies framing, and blocks cross-site form submission. Violations are reported back to the application and recorded in its logs.

Traffic records never contain a visitor IP address. Country is resolved at the network edge and only the two-letter code is kept. Each visit carries a per-day pseudonymous key derived from the request so repeat visits can be counted without identifying anyone; it is a pseudonym rather than an anonymised value, and we describe it as such deliberately.

Web-server access logs, like those of any hosted application, do contain client IP addresses. They are size-capped and rotated rather than kept indefinitely.

The database is dumped nightly, every dump is integrity-checked automatically, and copies are retained for 14 days. The restore procedure is documented and has been performed end-to-end as a drill, not just written down.

Dependencies are checked against published advisories on every release gate, and a release is blocked if the advisory position gets worse rather than being re-baselined.

Email [email protected] with the details and how to reproduce it. We will acknowledge your report within 3 business days and keep you posted on the fix.

Safe harbour. We will not pursue legal action against good-faith security research that respects our users' data and gives us a reasonable window to fix the issue before it is disclosed publicly. Do not access or modify data that is not yours, do not degrade the service for other people, and tell us before you tell anyone else. Do that, and you have nothing to worry about from us.

Ranksify holds no third-party security certification — there is no SOC 2 report or ISO 27001 certificate, and this page should not be read as implying one. The controls above describe what the system does today.