Security and your clients' data

Everything is stored in the UK, in Amazon Web Services' London region. Backup copies are kept in Ireland (EU) for up to 35 days, then overwritten.

When you close your account, your data is deleted straight away, apart from invoices, which the law says we keep for six years.

Every connection is encrypted. Browsers connecting to Digital Adept, and to agencies' own report addresses, use a post-quantum key exchange (X25519 with ML-KEM-768), so traffic recorded today can't be read by a future quantum computer.

The database, backups and files are encrypted at rest with AES-256, and secrets such as authenticator keys are encrypted again on top.

You connect your own Google account once and choose each client's Search Console property. We ask for read-only access, so we can never change a client's settings, and we never need their passwords.

Data from Google is used only to show you and your clients your own results: never for advertising, and never sold, in line with Google's API Services User Data Policy, including the Limited Use requirements.

There are no passwords to guess or leak. Everyone signs in with a code we email them, plus an authenticator app once it's turned on. Our own staff always use one.

Each sign-in code works once, for 15 minutes, and you can sign out on every device at once from Settings.

Every request is checked against the agency that made it. Our automated tests try to reach one agency's clients, reports and settings from another on every change, and from a client's portal, which sees only that client.

Our AI is Claude, run on Amazon Bedrock in Europe with zero data retention: nothing you send it is stored, and none of it is used to train AI models.

Every change to the app runs more than 250 security checks against the whole of it before it goes live, plus a test of every route for sign-in, separation between agencies and injection. A weekly OWASP ZAP scan looks for anything those miss.

The server installs security updates daily and is replaced with a freshly patched one every month. Dependencies are updated weekly and scanned on every change, AWS GuardDuty watches for threats, and spreadsheets you upload to import clients are scanned for malware, then deleted.

For your clients' data you're the controller and we're the processor. Our data processing agreement is part of the terms, and our privacy policy lists every service provider we use and what each receives.

Cloud Adept Limited is registered with the UK Information Commissioner's Office (ZC272649). If something went wrong that affected your data, we'd tell you and the ICO as the law requires.