Company / Security
SerpDad security. Your keys, your content, your site.
SerpDad security starts with what we never hold or do: we don't train AI models on your content, we can't change your Search Console, and we never publish to your site. Here is what we do with the data we keep.
Only claims we can show in the product or the docs. No badges we haven't earned.
Provider keys. Your keys stay yours, and stay encrypted.
SerpDad runs on your own DataForSEO and AI provider accounts. The keys belong to you, and each one is used only for its own workspace. SerpDad never falls back to a key of ours for your work.
- Encrypted at rest, with an encryption key kept separate from the rest of the app.
- Write-only: after you save a key, the browser sees only the provider, the last 4 characters and its status.
- Never written to logs, emails, links or error messages.
- Replacing or deleting a key asks for your password again, and the Owner gets an email when someone else changes one.
- Only the Owner and Admins can add, replace or delete keys.
Search Console. Read-only access. We never change anything there.
Connecting Search Console is optional. SerpDad asks Google for read-only access through Google's own sign-in, and stores the access token encrypted. It reads clicks, impressions, positions, pages and queries for the property you choose.
You can revoke access at any time.
Same rule for drafts. SerpDad never publishes. Drafts go to WordPress, Webflow, Shopify or Google Docs as drafts, and a person signs off by name first. Read the four refusals.
Your content. We don't train AI models on it.
It belongs to you
Your plans, briefs and drafts are your workspace content. SerpDad stores and processes them only to provide the service to you.
No model training
SerpDad does not use your content to train AI models. Your AI provider's own policy applies to the calls made on your key.
Deletion
Deleting a workspace removes its projects, plans, briefs, keys, Search Console connection and synced data. Encrypted backups roll off on a fixed schedule.
Sign-in and roles. Who can get in, and what they can do.
Two-factor authentication
A 6-digit code from an authenticator app, with 8 single-use recovery codes. It applies to Google sign-in too.
Passkeys and Google sign-in
Sign in without a password using a passkey, or continue with a Google-verified email.
Five roles, checked on the server
Owner, Admin, Manager, Editor and Writer. SerpDad checks the role for every action, not just in the interface.
Sensitive actions ask again
Changing keys, two-factor settings or passkeys asks you to confirm with your password, a passkey or Google.
Where data lives. Hosting and subprocessors, in full.
We keep one list of every company that helps run SerpDad, what each one does and where it processes data. Rather than restate it here and risk the two drifting apart, we point you to the source.
Traffic uses HTTPS everywhere, each workspace's data is kept separate, and backups are encrypted. No system is perfectly secure, and we won't pretend otherwise.
We do not hold a SOC 2 report or an ISO certification today.
Questions and answers.
Can't find the answer? Email us.
Where is my data hosted?
Our subprocessors page lists every company that helps run SerpDad, what each one does and where it processes data. The privacy policy explains how transfers are handled.
Does SerpDad train AI models on my content?
No. Your workspace content belongs to you, and SerpDad does not use it to train AI models. Your AI provider's own policy applies to the calls made on your key.
Can SerpDad change anything in my Search Console?
No. SerpDad asks Google for read-only access, stores the token encrypted, and you can revoke access at any time.
Who can see my provider keys?
Nobody can read a key back after it is saved. The app shows only the provider, the last 4 characters and the status, and only the Owner and Admins can add, replace or delete keys.
Do you support SSO?
Not today. You can sign in with a password and two-factor authentication, a passkey, or Google. If your team needs SSO, email us.
Do you have SOC 2 or ISO certification?
No. We do not hold a SOC 2 report or an ISO certification today. If your security review needs written answers, email us and we will answer them.
Need SSO, invoices or a security review?
Email us.
Tell us what your review needs and we'll answer it in writing. Write to [email protected].