Security Overview

Last updated: August 7, 2026

SEO.Cretorial AI uses administrative, technical and application-level controls to protect account data, OAuth tokens and business workspace information.

Access Controls

• Users authenticate through email/password or Google sign-in.
• Workspace access is limited by company membership and role-based permissions.
• Administrative actions are recorded in an activity audit log.

Credential and Token Handling

• Passwords are hashed before storage.
• OAuth tokens and provider credentials are encrypted at rest.
• Users can disconnect providers, and Google access can also be revoked from the user's Google Account.

Application Protections

• Production traffic uses HTTPS.
• Web forms use CSRF protection.
• API routes use bearer-token protection and permission checks.
• Input validation and output escaping are used throughout the PHP application.

Report a Security Concern

Email support@cretorial.com with a clear description of the issue, affected URL and steps to reproduce.