How LegitGeo keeps your data, and what it does not do yet.

• Row-level security on every table. The database is Supabase Postgres, and every table has row-level security switched on, so a signed-in user can read only rows that belong to their own organization.
• Isolation tests before releases. Automated tests sign in as one organization and try to read, change or move into another organization's brands, answers, competitors, keys and invitations. They are run before releases.
• Comparison groups never expose a business. Verified lift compares a business only with pooled rates from at least 5 businesses in at least 3 organizations, and the public lift library holds no business's own data.

• Sign-in is handled by Supabase Auth. LegitGeo never stores passwords itself, and every new account confirms its email address.
• Payments are handled by Stripe. LegitGeo never sees or stores full card numbers.
• Connected Google accounts are used only after their owner connects them, and their access tokens are encrypted at rest (AES-256-GCM).

• API keys are stored only as SHA-256 hashes and shown once, when they are created. Live keys and test keys are separate, and a test key cannot see live accounts.
• Every webhook is signed to the Standard Webhooks specification, with webhook-id, webhook-timestamp and webhook-signature headers. Failed deliveries are retried up to 8 times over 24 hours, and signing secrets are encrypted at rest.
• The embed card can be framed only by the partner's own domains. Its sessions are single-use and last 15 minutes; login links are single-use and last 5 minutes.

The partner page explains how to verify a webhook.

• A visitor's IP address is never stored. Only a keyed hash of it is kept, to enforce the limit of 5 checks per hour.
• The check reads only public pages, the way AI crawlers do, and needs no account.

legitgeo.com and app.legitgeo.com run on Vercel, the API and analysis worker on Railway, and the database and sign-in on Supabase. All traffic is served over HTTPS, and legitgeo.com and the app send HSTS. The full list of service providers, and what each one does, is in the privacy policy.

• No SOC 2 or ISO 27001 audit. We will say so here when one is under way.
• No two-factor sign-in for LegitGeo accounts yet.
• No published data region or backup schedule on this page yet. Ask us if you need either for a review.

Email hello@legitgeo.com with the subject “Security report”. Describe what you found and how to reproduce it, and give us a reasonable time to fix it before you share it. Please do not access other people's data, run denial-of-service tests or send spam while testing. The same contact is published in security.txt.