Security at NextEO

Your data

Your websites, scores, and history belong to your account. Every read and write is checked against your ownership or an active team membership at the database query layer, not just in the interface, so one customer can never see another customer’s data. Admin support access is audited, and support impersonation sessions are specially marked and blocked from changing passwords, two-factor settings, or billing.

Credentials we hold for you are protected at rest. Tokens for connected accounts (like Google Search Console or an ads account) are encrypted with AES-256-GCM, and API keys are stored only as SHA-256 hashes: you see the key once, and we keep only the hash.

We keep personal information out of our logs. Passwords, tokens, and authorization headers are redacted automatically, and support message contents are never written to logs.

NextEO fetches the web pages you ask us to analyze. Every server-side fetch of a customer-supplied address is validated first against private and internal network ranges (including encoded-address tricks), redirects are re-checked hop by hop, and downloads have size and time limits. The analysis engine can only reach the public web.

We do not sell your data, and we share it only with the service providers listed below, each of which receives only what its function needs. The AI engines we test against (OpenAI, Anthropic, Google, Perplexity, and xAI) receive the site content and business details involved in a test and handle that content under their own privacy terms, which are outside our control and may differ from ours.

Payments

All payments are processed by Stripe. Card numbers are entered on Stripe-hosted checkout pages and never touch NextEO servers. We store only the subscription state Stripe reports back to us, and every billing event Stripe sends is signature-verified before it is trusted.

Account security

Passwords are hashed with bcrypt (work factor 12) and are never stored or logged in plain text. Optional two-factor authentication (TOTP) is available on every account, and admin access requires it.

Signing in creates a server-side session, and sessions are revoked when you log out or change your password, so a stolen token does not outlive the action that should have killed it. Login and two-factor attempts are rate-limited and logged, two-factor challenges are single-use, and security tokens are generated with cryptographically secure randomness and compared in constant time.

Infrastructure

All traffic is served over HTTPS with HSTS, and standard security headers are enforced on every response. API access is limited to our own app origins, and endpoints are rate-limited, with the limits shared across servers so they cannot be sidestepped.

Dependencies are kept at zero known vulnerabilities as part of our release checks. The service runs on Render, and errors are monitored with Sentry with secrets redacted.

Subprocessors

We use a small set of service providers to run NextEO. Each receives only the data needed for its purpose:

• RenderApplication hosting and compute: the API, background workers, and cron.
• NeonManaged PostgreSQL database: your account, websites, scores, and connected-account data are stored here.
• UpstashManaged Redis for background job queues, rate limiting, and usage counters.
• StripePayment processing and subscription billing (card details are entered on Stripe and never reach our servers).
• ResendTransactional and lifecycle email delivery.
• SentryError monitoring (with secrets and personal data redacted).
• OpenAIAI visibility testing, the EO assistant (ChatGPT), and the ChatGPT Ads integration.
• AnthropicAI visibility testing (Claude).
• GoogleAI visibility testing (Gemini), the Search Console and Analytics connections you choose to enable, business-listing and review lookups for reputation (Google Places), and optional Google sign-in.
• PerplexityAI visibility testing (Perplexity).
• xAIAI visibility testing (Grok).
• SerpAPISearch-result and review-listing lookups for reputation monitoring (optional features).

On our marketing site we also load consent-gated advertising and analytics providers (Google Analytics, Meta, LinkedIn, Apollo, and the OpenAI Ads pixel), only after you accept cookies. They are listed in our Cookie Policy.