Security
Effective September 11, 2026
Security is a product requirement, not an add-on. This page describes the controls protecting your account, your client data and the audit infrastructure.
Data isolation
Every business, audit, report and integration record is owned by a single account and protected by row-level security enforced in the database itself. Access is denied by default and granted only to the owning user or an administrator.
Credential handling
API credentials live in server-side secret storage and are read only inside server functions. No credential is ever included in client-side code, network responses or logs.
Safe crawling
Submitted URLs are validated before any request is made. We require HTTPS, reject private and loopback network ranges to prevent server-side request forgery, cap the number and size of fetched pages, and enforce request timeouts.
Abuse prevention
Audit requests are quota-limited per plan and rate-limited per account. Concurrent audits on the same business are blocked, and administrators can cancel a runaway crawl.
Roles and administration
Roles are stored in a dedicated table and verified server-side with a security-definer function, never inferred from client state. Administrative actions are executed only by verified admin server functions.
Reporting a vulnerability
Email hello@localrankgenius.com with a description and reproduction steps. We acknowledge reports within two business days and will not pursue action against good-faith research.