AEO Owl runs on Cloudflare Workers (CDN + serverless compute) and Supabase Pro (Postgres + Auth). No data leaves these two providers except for the third-party services described below. Daily automated backups run on Supabase with 7-day retention.
Row-Level Security (RLS) is enabled on every public database table. Every read and write is gated by your authenticated session. You can only see audits for brands you own. No customer ever sees another customer's data — not in the UI, not via an API call, not by accident.
The Supabase service role key (which bypasses RLS) lives only in our Cloudflare Worker secrets — never in browser code, never in the GitHub repo.
When you run an audit, we send only the audit questions you configured to AI engines via OpenRouter (7 engines) and SerpAPI (1 engine — Google AI Overviews). We do not send your brand's audit history, your competitor list metadata, your account info, or any other customer data. We retain the responses long enough to compute your scores and your Owl Report, then those responses stay in your account — never used by us to train any model or improve any other customer's experience.
OpenRouter and SerpAPI have their own data policies for the underlying providers (OpenAI, Anthropic, Google, etc.). Major API providers typically do not train their models on API queries. We don't claim to control their policies for you, but we keep the data we send minimal so you don't have to take our word for it.
All payments go through Stripe-hosted Checkout. AEO Owl never touches your card data. We don't store, log, process, or transmit card numbers, CVVs, or expiration dates — Stripe handles all of it. Stripe is a PCI-DSS Level 1 Service Provider. Subscription self-service is handled by Stripe's Customer Portal, hosted on Stripe's infrastructure.
All Stripe webhooks are signature-verified and idempotent — a replayed webhook can never double-charge or double-credit you.
Authentication uses Supabase Auth with bcrypt password hashing. TOTP-based two-factor authentication is available in Profile → Security — we recommend enabling it. We never store passwords in plaintext.
The internal admin surface (`aeoowl.com/admin`) is gated by two layers: a Cloudflare Access One-Time PIN gate at the edge (only emails on the allowlist receive PINs), and a Worker-side email allowlist check on every API call. Every admin write (granting credits, force-running audits, processing deletion requests) is logged to an append-only audit table with the actor, action, target, payload, and timestamp.
We do not have a "log in as customer" impersonation feature — admins can read your data via support escalation if you ask, but cannot pose as you. We also do not have a free-form SQL panel in admin — every admin action goes through a specific audited endpoint.
The audit endpoints are protected by Cloudflare WAF rate limits at the edge and additional per-user caps in the Worker (5 audits/hour, 20/day per account). AI API spend is triple-capped — prepaid balance + per-key limit + Cloudflare AI Gateway budget — so a leaked API key cannot drain unbounded spend.
Daily digest emails summarize every admin action from the previous 24 hours. A spike check fires immediate alerts if admin activity exceeds a threshold within an hour. Engine health is probed every 6 hours; state changes (an engine going down) trigger an admin alert. If your audit is queued because of an engine outage, we auto-refund after 12 hours.
Every Worker deploy is tied to a Git SHA — no direct dashboard edits to production code. All code changes go through pull request review on GitHub. The Supabase JavaScript library loaded by the dashboard is pinned to a specific version with a Subresource Integrity (SRI) SHA-384 hash — if a CDN serves a tampered file, the browser refuses to execute it.
You can delete your account yourself at any time from Profile → Delete account. Deletion is scheduled with a 30-day grace period — you can reverse it any time before the deadline by signing in and choosing “Keep my account.” If you have an active Monitor subscription, it is set to cancel at the end of the current billing period and the grace clock starts then. Unconsumed Dashboard audits expire silently with deletion. You can also email admin@aeoowl.com to request deletion, and we respond within 24 hours. See our Privacy Policy for the full data-handling details.
If you believe you have discovered a security issue, please email admin@aeoowl.com. We aim to respond within 24 hours. We welcome responsible-disclosure reports from white-hat researchers and customers alike.
Need a DPA, a completed security questionnaire, or specific compliance documentation for your purchase? Email admin@aeoowl.com and we'll work through what's achievable.
