1. Your Google connection
- We request read-only access only: Search Console (
webmasters.readonly) and Analytics (analytics.readonly). glimana cannot change anything in your Google account. - Access tokens are stored encrypted in the database.
- You can disconnect at any time from the panel or from your Google account settings.
2. Your account
- Passwords are stored as one-way hashes; we cannot see them.
- Two-factor authentication can be turned on from your account page, with recovery codes.
- API keys themselves are never stored, only a hash. AI provider keys are stored encrypted and only their last 4 characters are shown.
- The sign-up and free audit forms are protected by an automatic bot check.
3. Infrastructure
- All traffic goes over HTTPS, and browsers are told to use HTTPS only (HSTS).
- Data is held in a data centre in the United Kingdom and backed up every night.
- What we keep and for how long is set out in the Privacy Policy.
4. Reporting a vulnerability
If you find a security issue, email support@glimana.com. The contact is also in our security.txt file.
- Tell us step by step how to reproduce it.
- Avoid accessing other people's data, deleting data, or tests that slow the service down.
- Please don't publish the issue until we have fixed it. We confirm receipt within two business days.