indexive

Security

We hold your site content, your brand material and, when you grant it, write access to your CMS. We treat that access as the most sensitive thing we have.

Tenant isolation

  • Every customer record carries an organization id, and Postgres row-level security is on for every tenant table. Access is decided in the database, not only in application code.
  • An automated suite checks every tenant table against every role on every build: a client user can never read or change another organization's data, and staff see only the organizations they are assigned to.
  • Background workers use a service identity and scope every job to a single organization.

Access control

  • Sign in with Google, Microsoft, magic link, or SAML 2.0 single sign-on (Okta, Entra ID, OneLogin, JumpCloud) on Scale. Your domains can require SSO.
  • Six roles: Indexive admin, strategist and engineer on our side; admin, approver and viewer on yours. Your admins invite people and change roles; they cannot grant our staff roles.
  • Changes to your site follow risk tiers. Higher-risk changes need your approval, and your guardrails can only make the rules stricter.

Credentials

  • CMS passwords, API keys and tokens are envelope-encrypted (AES-256-GCM, per-secret data keys wrapped by a master key held outside the database).
  • No client-facing role can read a stored credential. They are decrypted just in time inside the worker that uses them.
  • Every write to your site is preceded by a snapshot, so any change can be rolled back.

Audit log

  • Invites, role changes, approvals, credential changes, exports and deletions are written to an append-only audit log. A database trigger blocks edits and deletes, including from our own service accounts.
  • Your admins can filter the log and export it as CSV at any time.

AI and your data

  • Model calls go to Anthropic (Claude) under commercial terms that do not allow training on your inputs or outputs, and to OpenRouter with zero-data-retention routing.
  • Your content is used only to produce work for your organization. It is never shared across customers.

Infrastructure

  • Hosted on Supabase (Postgres, Auth, Storage), Vercel (web) and Fly.io (workers) in the United States. Data is encrypted in transit and at rest.
  • Daily backups with point-in-time recovery. Production access is limited to named engineers with MFA.

Your data, your exit

  • Request a full export at any time: one JSON file with every record we hold for your organization.
  • On termination we export, deliver, and permanently delete your workspace data within 30 days, and revoke our access to your systems.

Subprocessors

We give 30 days' notice before adding a subprocessor that handles personal data.

Supabase
Database, authentication, file storage
Vercel
Web application hosting
Fly.io
Background workers
Anthropic
Language model inference
OpenRouter
Embeddings and model routing
DataForSEO
Search and ranking data (no personal data)
Google
Search Console, Analytics and sign-in APIs
Resend
Transactional email
Sentry
Error monitoring

Agreements and disclosure

A Data Processing Agreement with Standard Contractual Clauses is available on request, and we answer security questionnaires.

Found a vulnerability? Email security@indexive.ai. We acknowledge within 2 business days and do not pursue good-faith research.