Security and privacy
Built to pass your IT review.
What Georgie reads, where your data lives, who can access it and how long we keep it. In plain language, for your security and procurement teams.
- Public pages
- Catalog, read-only (optional)
- AI Visits tracking (optional)
- Encrypted in transit and at rest
- Row-level security on every table
- Team access by single sign-on
- Buyer questions
- Public page content
- Scores and fixes
- Reports
Read-only by design
Georgie reads your public pages and, if you connect it, your catalog. It never writes to your store.
Encrypted everywhere
HTTPS for every connection, and encryption at rest in our database.
Locked-down data
Row-level security on every table. Database keys never leave our servers.
No model training
We use AI providers' business APIs. Your data isn't used to train their models.
What Georgie reads
Only what it needs to measure AI visibility.
Most of what Georgie reads is already public. The rest is optional, and you choose what to connect.
- Public pagesYour storefront, read the way AI crawlers read it: the same pages any visitor can see.
- Your catalog, if you connect itProducts, themes and order counts through read-only access. Georgie never edits your store, and you can disconnect at any time.
- AI Visits tracking, if you install itThe page URL, the referrer, the user agent and a one-way hash of the visitor's IP address. No cookies, and no IP address is ever stored.
- Your team's contact detailsNames and work emails, to run your account and send you reports.
Where your data lives
Established infrastructure, in the United States.
Georgie runs on providers that are bound by contract to protect your data and to use it only to provide their service.
- DatabaseSupabase (PostgreSQL), hosted on Amazon Web Services in the United States (us-east-1).
- ApplicationVercel, in the United States. Background work, such as scans, runs on Inngest.
- Outside QuebecAs Quebec's Law 25 requires, we disclose that data is processed outside Quebec, mainly in the United States.
Who can access it
Access is limited, and keys stay on our servers.
The database is not reachable from the internet with a public key, and every table has row-level security turned on.
- Our teamSigns in with company single sign-on, with roles. Accounts outside our company domain are refused.
- Your teamClient logins are coming. They will use single sign-on, with access limited to your own sites.
- Our codeDatabase and provider keys are used only on our servers, never in a browser.
AI providers
What we send to AI engines, and what we never send.
To measure your visibility, Georgie asks AI engines the questions your buyers ask and shares public content from your site.
Buyer questions about your category, and public content from your pages.
Your customers' data, your team's emails, or anyone's IP address.
We use the providers' business APIs, which don't use API data to train their models by default.
Service providers
Who processes data for Georgie.
The providers that help us run Georgie, what they do, and what they receive.
| Provider | Purpose | Data they receive |
|---|---|---|
| Vercel | Website and application hosting | Requests to the site and the app |
| Supabase (on AWS) | Database | Account, scan and tracking data |
| Inngest | Background processing of scans | Scan job details |
| OpenAI, Anthropic, Perplexity, xAI | AI answers and page analysis | Buyer questions and public page content |
| Firecrawl | Retrieval of public web pages | Public page URLs |
| SerpAPI | Web presence checks for Trust Score | Your brand and domain names |
| HubSpot | Customer relationship management | Contact details and scan summaries |
| Resend | Email delivery | Email addresses and results summaries |
| Cloudflare Turnstile | Bot check on the scan form | Browser signals during the check |
| Single sign-on for our team | Team member identity |
- Vercel
- Website and application hosting
- Data they receive: Requests to the site and the app
- Supabase (on AWS)
- Database
- Data they receive: Account, scan and tracking data
- Inngest
- Background processing of scans
- Data they receive: Scan job details
- OpenAI, Anthropic, Perplexity, xAI
- AI answers and page analysis
- Data they receive: Buyer questions and public page content
- Firecrawl
- Retrieval of public web pages
- Data they receive: Public page URLs
- SerpAPI
- Web presence checks for Trust Score
- Data they receive: Your brand and domain names
- HubSpot
- Customer relationship management
- Data they receive: Contact details and scan summaries
- Resend
- Email delivery
- Data they receive: Email addresses and results summaries
- Cloudflare Turnstile
- Bot check on the scan form
- Data they receive: Browser signals during the check
- Single sign-on for our team
- Data they receive: Team member identity
Our infrastructure providers, Vercel and Supabase, maintain SOC 2 Type II reports.
Retention and deletion
Kept only as long as it's useful.
You can ask us to delete your data at any time.
Kept for the length of our engagement, and deleted at your request.
Deleted automatically 24 months after the scan.
Access, correction, deletion and portability, as described in our privacy policy.
Responsible disclosure
Found a security issue?
Tell us. We'll confirm receipt, investigate, and keep you posted until it's fixed. Please don't access other customers' data or disrupt the service while testing.
FAQ
Security questions
- Are you SOC 2 certified?
- Not ourselves, yet. Our infrastructure providers, Vercel and Supabase, maintain SOC 2 Type II reports, and we can walk your team through how Georgie uses them.
- Can you complete our security questionnaire?
- Yes. Book a call or email us, and we'll answer it with your team.
- Do we have to install anything on our store?
- No. Georgie reads your public pages. Connecting your catalog and installing AI Visits tracking are both optional.
- Does Georgie use our data to train AI models?
- No. Neither do the AI providers we use: their business APIs don't train on API data by default.
- Who is responsible for privacy at Georgie?
- Our privacy officer, named in our privacy policy.
Bring your security team to the call.
We'll walk through how Georgie handles your data and answer your questionnaire.