Security

Enterprise-grade security, SME-friendly platform.

1. Overview

Atlio Information Technology LLC (“Atlio Information Technology”) takes the security of your data seriously. Our AI agents read your keyword data, search-console metrics, and website content to deliver SEO and AI-search insights. Because that data is sensitive, we design every layer of our platform with security as a first-class requirement — not an enterprise upsell. The same row-level isolation, encryption, and access controls protect every workspace, on every plan.

This page describes the technical and organisational measures we maintain to protect your data. It is intended for customers, prospects, agencies managing multiple client workspaces, and security researchers evaluating SearchChamp. SearchChamp is a product of Atlio Information Technology.

2. Compliance and certifications

Honesty matters more than badges. Here is exactly where we stand today — nothing aspirational is presented as complete.

Customers on Pro and Agency plans may request a copy of our security questionnaire responses under NDA by contacting [email protected].

3. Security pillars at a glance

Four layers, each with a concrete control rather than a marketing claim:

4. Infrastructure

The SearchChamp platform is hosted on Amazon Web Services (AWS) in the eu-west-1 (Ireland) region. We chose Ireland as our primary region to keep EEA customer data within the European Economic Area.

• Network isolation: all production compute resources run inside a private Virtual Private Cloud (VPC). Database and worker tiers are deployed in private subnets with no direct inbound internet access. Only the API Gateway and Amplify front-end endpoints are internet-facing.
• Compute: application logic runs on AWS Lambda (auto-scaling, ephemeral execution). There are no long-lived EC2 instances in the data path.
• Database: RDS PostgreSQL 16 (production) with automated daily backups retained for 7 days, encrypted with AWS KMS.
• CDN and DDoS protection: static assets and marketing pages are served through AWS CloudFront with AWS Shield Standard enabled.
• High availability: we target 99.9% monthly uptime and notify affected customers of significant incidents by email.

5. Encryption

5.1 Encryption in transit

All data transmitted between your browser and SearchChamp’s servers is encrypted using TLS 1.3. We enforce HTTPS for all endpoints and reject connections over TLS 1.0 or 1.1. HTTP Strict Transport Security (HSTS) is enabled with a one-year max-age and includeSubDomains.

Traffic between SearchChamp’s internal services (Lambda functions, RDS) traverses private AWS network fabric and is encrypted in transit using AWS-managed TLS.

5.2 Encryption at rest

All data stored by SearchChamp is encrypted at rest using AES-256:

• RDS PostgreSQL database: encrypted with AWS KMS-managed keys (aws/rds).
• Database backups: encrypted with AWS KMS.
• Secrets (API keys, OAuth tokens, database credentials): stored in AWS Secrets Manager, with a documented rotation procedure.
• S3 buckets (logs, exports): server-side encryption with S3-managed keys (SSE-S3).

5.3 Secrets management

No secrets are committed to code repositories or configuration files in source control. Production secrets are stored in AWS Secrets Manager and injected into services at deploy time.

6. Access controls and tenant isolation

6.1 Internal access

Access to production infrastructure is governed by the principle of least privilege:

• Production database access is restricted to authorised engineers and reachable only via an SSH bastion host inside the private VPC; all AWS console and API access requires MFA and is logged to CloudTrail.
• AWS IAM roles follow least-privilege: Lambda functions carry only the permissions they need for their specific task.
• Multi-factor authentication (MFA) is enforced for all Atlio Information Technology team members accessing AWS Management Console and GitHub.
• All privileged-access sessions are logged to CloudTrail and auditable.

6.2 Customer access controls

• Authentication: managed by AWS Cognito. Passwords are stored using AWS Cognito's secure hashing and never stored in plain text.
• MFA: optional TOTP-based MFA is available to all users.
• Session management: access tokens expire after 1 hour. Refresh tokens expire after 30 days.

6.3 Your data, your tenants

Tenant isolation is enforced where it counts — in the database, not just the application layer. Every workspace’s data is partitioned by Postgres Row-Level Security (RLS): each query carries an authenticated workspace context, and the database itself refuses to return rows that belong to another workspace. An application bug, a mistyped identifier, or a compromised request cannot read across organisations, because the boundary is enforced one layer below the code.

This matters most for agencies. If you manage ten client sites in SearchChamp, each client’s keywords, audits, search-console data, and AI-visibility results live in a separately-isolated tenant. There is no shared table a query could accidentally span, and white-label workspaces inherit the same isolation. You can grant and revoke seat access per workspace without ever exposing one client’s data to another.

7. Application security

• OWASP Top 10: our development process includes review against the OWASP Top 10 for common web application vulnerabilities including injection, XSS, CSRF, and broken authentication.
• Input validation: all API inputs are validated with strict TypeScript types and Zod schemas before processing. Parameterised queries are used for all database access; raw SQL concatenation is prohibited.
• Dependency scanning: dependency vulnerability alerts are enabled on our repositories, and critical CVEs are prioritised for immediate remediation.
• Rate limiting: API endpoints are rate-limited to prevent abuse.
• Audit logging: data-mutation, authentication, and PII-access events are logged with actor, timestamp, resource, and IP address. Logs are retained for 30 days and cannot be deleted by standard operational roles.

8. Data handling and privacy by design

We collect what the product needs to work, and no more. Two practices are worth calling out because they are unusual and verifiably true.

8.1 Verified-bot analytics — raw IPs are never persisted

SearchChamp’s GEO module tells you which AI crawlers are actually reading your site. To do that honestly, it has to confirm a crawler is who it claims to be — a user-agent string alone proves nothing and is trivially spoofed.

So when a crawler visit is captured, we verify the source IP against the vendor’s published IP ranges in memory, at ingest time, and only then hash the IP. The raw IP address is never written to the database, never logged, and never leaves the request. What persists is a one-way hash plus a verification verdict — we label a visit “Verified” only when the IP or ASN actually confirms the vendor; an unconfirmed visit is recorded as pending or unverifiable, never falsely as verified. The beacon that powers this only fires on a matched bot user-agent, so no human visitor’s IP is involved at any point.

This is privacy by design: you get trustworthy crawler attribution without us hoarding raw network identifiers.

8.2 Data minimisation to AI providers

When our agents call third-party models, they send only the content required for the task — your page text, keywords, and search-console metrics. Under the providers’ commercial API terms, your inputs are not used to train external models; we use reduced-retention options where the provider makes them available. Keyword and SERP lookups to our data provider contain keywords and URLs only, never end-user personal data.

8.3 Retention and deletion

Audit and access logs are retained for 30 days. Verified-bot visit records are purged on a rolling 90-day retention window. On account closure you can request export and deletion of your workspace data under GDPR and UAE PDPL; see our Privacy Policy for the full schedule.

9. Sub-processors and vendor security

We use a small, deliberate set of sub-processors, each chosen for its security posture. We apply third-party security standards to every vendor that processes SearchChamp customer data:

• Anthropic (Claude): powers our AI agents. SOC 2 Type II certified; model inputs are not used to train Anthropic models under its commercial API terms; transmitted over HTTPS.
• OpenAI: additional AI-agent and AI-visibility coverage. SOC 2 Type II certified; API inputs are not used to train OpenAI models under its API terms.
• DataForSEO: keyword, SERP, and backlink data. Queries are limited to keywords, URLs, and domain names and are not intended to contain personal data.
• Stripe: billing and payments. PCI-DSS Level 1 certified; raw card data never passes through SearchChamp servers.
• Google: Search Console and Analytics integrations and AI Overview tracking, connected with your explicit OAuth consent and revocable at any time.
• AWS: hosting, Cognito authentication, and storage. Holds ISO 27001, SOC 1/2/3, and PCI-DSS, among others.

The complete, current list — with each sub-processor’s purpose, data categories, and processing location — is maintained at /legal/sub-processors. We give at least 14 days’ notice before adding or replacing a sub-processor, consistent with our Data Processing Addendum.

10. Incident response

Atlio Information Technology maintains an incident-response process covering detection, containment, eradication, recovery, and post-incident review. Key commitments:

• Detection: automated anomaly detection via CloudWatch alarms monitors error rates, unusual API call patterns, and failed authentication spikes.
• Notification: in the event of a confirmed personal data breach, we notify affected Controllers without undue delay, and in any event within 72 hours, consistent with GDPR Article 33. We include the nature of the breach, data categories affected, estimated number of records, and remediation steps taken.
• Severity levels: incidents are triaged by severity, with critical incidents receiving an immediate, all-hands response.
• Post-mortems: significant incidents result in a written post-mortem shared with affected customers.

11. Vulnerability disclosure

We operate a responsible disclosure programme. If you discover a security vulnerability in the SearchChamp platform, please email [email protected] with a description of the issue and steps to reproduce it. We ask that you:

• Give us at least 90 days to investigate and remediate before public disclosure;
• Avoid accessing or modifying customer data beyond what is required to demonstrate the vulnerability;
• Not perform denial-of-service attacks or disrupt services for other users.

We aim to respond to reports within 2 business days and, with your permission, will credit you publicly once the issue is resolved. We do not offer a paid bug bounty programme at this time.

12. Contact

Security enquiries, responsible disclosure reports, and security questionnaire requests: