Searchedly

Trust

Security at Searchedly

Customers trust us with their product data and their connections to AI agents. Here's how we protect both.

How we protect your data

  • Tenant isolation

    Every customer's data is separated in the database itself with row-level security, so one organization can never read another's records, even if application code has a bug.

  • Encryption

    All traffic uses TLS with HSTS. Secrets such as API credentials are additionally encrypted with AES-256-GCM using keys kept outside the database.

  • Identity and access

    Sign-in runs through WorkOS, with multi-factor authentication available to every user and SAML or OIDC single sign-on for enterprise customers. Five roles limit what each teammate can do.

  • Tamper-evident audit log

    Sensitive actions are recorded in an append-only log where each entry is chained to the previous one by a cryptographic hash, so edits or deletions are detectable.

  • Secure development

    Every change is reviewed and tested automatically, including dependency vulnerability checks, secret scanning and static analysis, before it can ship.

  • Safe outbound requests

    When we fetch your public pages, requests can only reach the public internet. Internal and private network addresses are blocked to prevent server-side request forgery.

  • Abuse protection

    Rate limits, request size limits and idempotency keys protect the API from overload and accidental duplicate actions.

  • Privacy by design

    We collect only what the service needs, delete operational records on a fixed schedule, and never sell personal data or use customer content to train AI models.

  • Incident response

    We maintain a written incident response plan and notify affected customers of a personal data breach without undue delay, within 72 hours of confirming it.

Compliance

We only list what is true today. Items marked planned are in progress, not completed.

  • GDPR and UK GDPRSupported

    Data Processing Addendum with Standard Contractual Clauses for international transfers.

  • CCPA / CPRASupported

    We act as a service provider and never sell or share personal information.

  • WCAG 2.2 AATested

    Automated accessibility checks run on every change.

  • SOC 2 Type IIPlanned

    Controls are being built to the SOC 2 criteria; an audit will follow once they have operated for a full period.

  • Independent penetration testPlanned

    Scheduled before our first enterprise agreement. Summary available under NDA.

Infrastructure and vendors

Searchedly runs in the United States on Render. Sign-in, email delivery and error monitoring are handled by specialist providers, each bound by a data processing agreement. The full list is on our subprocessors page, and we give 30 days' notice before adding one.

Report a vulnerability

Email security@searchedly.com. We acknowledge reports within 3 business days and won't pursue good-faith research that follows our responsible disclosure policy. Security questionnaires and our DPA are available from the same address.