Trust & Security
Built to earn your trust — and keep you in control.
ConveyLoop works inside the tools you already trust — your Git repo, your CMS, your social and analytics accounts. That access is deliberately constrained: your application code stays untouched, you decide what runs automatically, and your data stays isolated to your organization.
How ConveyLoop earns that trust
Your application code stays untouched
When you connect a Git repo, ConveyLoop commits SEO content to a dedicated, isolated directory. It is designed to only write to that directory and does not read, modify, or access your application source code — so automated publishing never puts your app at risk.
You stay in control
Choose an approval mode — full auto, semi-auto, or manual review — so nothing publishes without the oversight you want. Cost budgets are estimated and reserved before any generation runs, and content that can’t verify itself against your brand facts is routed to a human review queue instead of going live.
Your data is isolated per organization
Every request verifies the signed-in user’s organization membership before any data is touched, and the database enforces row-level security so users can only reach data belonging to their own organization — defense in depth, even against an application-level bug.
Encryption at rest & in transit
Data stored in our database is encrypted at rest using industry-standard encryption provided by our infrastructure partner. Every connection between your browser, our servers, and third-party integrations uses TLS 1.2 or higher to help protect your data in transit.
Secure OAuth token management
When you connect platforms like WordPress, Google, or your social channels, ConveyLoop stores OAuth tokens with symmetric encryption. Tokens are automatically refreshed and can be revoked at any time from your integration settings.
Input validation, rate limiting & webhook verification
All user inputs are validated server-side using strict schema checks. API endpoints are rate-limited to prevent abuse, and webhook endpoints verify signatures before processing events.
Our security approach
- 🔒
Security-framework informed design
Our controls are informed by widely adopted security frameworks and industry best practices around access management, encryption, and monitoring. We continuously review and improve these practices as our product evolves.
- 🌍
Privacy-first data handling
Security and privacy go hand in hand. We collect only what we need, limit access to your data to what is required to operate the Service, and give you control over your data. See our Privacy Policy for full details.
- 📊
Cookieless page measurement
The ConveyLoop Metrics script that runs on your pages is inline and first-party: nothing is loaded from a third-party domain, no cookies are set, and no browser storage is written. The events it sends carry no visitor or session identifier, and the visitor’s IP address and user agent are used only transiently for rate limiting and bot filtering — never stored. See our Privacy Policy for the full description.
- 💳
Payment security via Stripe
ConveyLoop never stores credit card numbers. All payment processing is handled by Stripe. Card data never touches our servers.
- ☁
Trusted cloud infrastructure
Our application runs on Vercel and Supabase, established cloud platforms with their own rigorous security programs.
- 🛡
Common vulnerability mitigations
We apply mitigations for well-known web application vulnerabilities, including server-side input validation, strict output encoding, authentication checks on every request, and webhook signature verification.
Operational security practices
Least-privilege access
Team members have access only to the systems and data required for their role.
Logging & monitoring
Application errors and security-relevant events are reported to our monitoring, and our hosting provider keeps request logs.
Reporting a vulnerability
Found a security issue? Tell us through the contact form’s Security topic, which goes straight to a person. Our contacts are also in security.txt.