Implemented controls
Organization data is isolated in the database
Customer-owned records are protected by Postgres row-level security. The access rules are verified against allow and deny cases, so a member can read their own organization but not another organization's data.
Sessions are checked at the server boundary
Routes that handle customer data validate the session with the authentication service on the request. Authorization is not based on a browser cookie alone.
Payments stay with the payment provider
Checkout is hosted by Dodo Payments. Zyobit stores the identifiers needed to reconcile a subscription, never card numbers, and verifies billing webhooks before changing account access.
Public signals and connected data
Public audits need no account connection
A public audit uses a website or business identifier and location. You do not need to share the business's password or connect its accounts. Public reports can be viewed by anyone with the report link, so keep confidential information out of audit inputs.
Public signals and connected data have different boundaries
Public audits use website content, public listings and review metadata, search results and AI-assistant answers. Website crawling respects robots.txt. Data from connected customer accounts is accessed through separately authorized integrations, where those features are available.
Account connections and permissions
Where enabled and configured, Google Business Profile and Search Console connections use Google's OAuth consent screen. Search Console requests read-only access; Business Profile uses Google's business-management scope, which is broader than read-only. Review the permissions before connecting an account. Stored tokens are encrypted, and connections can be disconnected from Settings.
Connect only accounts you own or have permission to manage. A public audit does not require these integrations.
Storage and protection
Tenant isolation
Every organization's data — audits, businesses, settings — sits behind Postgres row-level security, not application-layer filtering alone. A query scoped to the wrong organization returns nothing at the database, not just at the screen.
Sessions are re-verified, not just trusted
Every page that touches data validates the session against the auth server directly on that request. A stale or forged cookie doesn't get treated as a login the way a cookie-only check would.
Audit logs use hashed IP identifiers
Public audit logging uses a salted one-way hash of the requester's IP address to help prevent abuse. The audit log does not store the plain IP address. This describes Zyobit's audit logging, rather than a claim about every hosting or network provider's logs.
Card numbers never reach our servers
Checkout and billing run through Dodo Payments. Zyobit's servers and database see the payment-provider customer and subscription identifiers needed to manage access — never a card number — and every billing webhook is signature-verified before anything is written.
Data retention and deletion are described in the Privacy Policy.
Service providers
These providers support the product. The features and providers configured for the service determine which are used.
- Supabase
- Database, authentication, row-level security
- Dodo Payments
- Billing and payment processing
- Gemini AI-visibility checks and authorized Google account integrations, where enabled
- SerpApi
- Public business listing and search data, when configured as the market-data provider
- DataForSEO
- Alternative public market-data provider, when configured
- Inngest
- Background audit jobs and scheduled refreshes, where enabled
- Upstash
- Shared rate limiting and abuse prevention, when configured
- Resend
- Customer notification emails, when enabled
- Kit
- Newsletter subscriptions and email delivery, when configured
For organization-specific data-processing questions, see the DPA overview or contact our team.
Certification status
Zyobit has not completed a SOC 2 audit. The controls described on these pages are implemented in the product, but have not been independently audited. A provider's certification does not certify Zyobit. Any future certification will be described here after completion.
Questions and security reporting
For agency reviews or a signed DPA, contact partners@zyobit.com. For a suspected security issue, email support@zyobit.com with the affected feature and enough detail to help us investigate. Do not include passwords, access tokens or other confidential credentials.
For personal data requests, contact privacy@zyobit.com. Read our Privacy Policy and Terms of Service for the full policies.