Security

Cloud infrastructure

GeoScript runs on Amazon Web Services (AWS) via Supabase (us-east-1 region), with application hosting and global edge delivery via Vercel. These providers maintain their own industry-leading security certifications: AWS holds ISO 27001, SOC 1/2/3, PCI DSS, and FedRAMP authorizations. We inherit their physical security, environmental controls, and hardware-level protections.

High availability and redundancy

The GeoScript database runs on Supabase's managed PostgreSQL with automatic replication across multiple availability zones. The application layer is deployed via Vercel's globally distributed edge network. Daily automated backups are retained for 30 days with point-in-time recovery. Backup integrity is tested regularly.

Network security

All public-facing endpoints are protected by Vercel's DDoS mitigation and Supabase's network-layer controls. Database access is not exposed to the public internet — all queries route through authenticated API layers. Connection strings and service credentials are stored as encrypted environment variables, never in code.

Data residency

All primary GeoScript data — account data, Signal Data, billing records — is stored in the United States (AWS us-east-1). Edge caching via Vercel's CDN may serve static assets from globally distributed nodes, but no personal data is stored in edge caches. Customers requiring EU data residency should contact us to discuss options.

Principle of least privilege

GeoScript personnel are granted access to systems and data only to the extent required for their role. Access rights are reviewed when roles change and revoked promptly on offboarding. No personnel have standing access to production customer data outside of documented support and incident response contexts.

Multi-factor authentication

Multi-factor authentication (MFA) is required for all GeoScript administrative access — including cloud infrastructure consoles, database management interfaces, deployment systems, and third-party service dashboards. MFA cannot be disabled for privileged accounts.

Customer account security

Customer accounts are authenticated via Supabase Auth, which supports email/password with bcrypt hashing, OAuth providers, and MFA via TOTP authenticator apps. Passwords are never stored in plaintext. Session tokens are short-lived (1-hour access tokens with rotating refresh tokens) and stored as httpOnly, Secure, SameSite=Strict cookies.

Role-based access (RBAC)

Within GeoScript accounts, access to dashboards, reports, and settings is controlled by role-based permissions. Account owners control which Authorized Users have access to which features and data within their subscription.

Access logging

Administrative access to production systems is logged. Logs are retained for 13 months and reviewed in the event of a security incident.

What the Script does and doesn't do

The GeoScript Script is designed with a minimal, scoped data collection model. It collects AI search signals (crawler visits, referral sessions, citation events) and nothing else. It does not capture form inputs, keystrokes, page content, user credentials, or any personally identifiable information of website visitors. Full details are in the Data Policy.

No cookies on visitor devices

The Script does not set any persistent cookies on website visitors' devices. It does not participate in cross-site tracking, behavioral advertising networks, or third-party data broker pipelines.

Script integrity

The Script is served from a versioned, integrity-protected endpoint. Customers can implement Subresource Integrity (SRI) checking to verify the Script has not been tampered with between GeoScript's servers and the end-user's browser. SRI hash values for each Script version are available on request.

Data transmission from Script

All data transmitted from the Script to GeoScript's ingest servers uses HTTPS (TLS 1.2+). The Script does not transmit data to any third-party endpoint — only to GeoScript's own ingest API.

Secure development practices

GeoScript follows security-by-design principles across the product lifecycle. Code changes undergo review before deployment. Dependencies are scanned for known vulnerabilities (CVEs) and patched on a priority basis. Critical security patches are applied as soon as practicable after disclosure.

OWASP protections

The GeoScript platform is built with protections against the OWASP Top 10 vulnerabilities, including:

• SQL injection prevention via parameterized queries (Supabase ORM)
• XSS prevention via React's DOM sanitization and Content Security Policy headers
• CSRF protection via SameSite cookie attributes and CSRF tokens
• Rate limiting on all authentication and API endpoints (Upstash Redis)
• Security headers enforced: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy

API security

All GeoScript API endpoints require authentication. Unauthenticated requests are rejected with 401. Rate limiting prevents brute-force and abuse. API keys are scoped to specific permissions and can be rotated or revoked from the account dashboard.

Penetration testing

GeoScript conducts or commissions security assessments of its platform and infrastructure. Enterprise customers may request a summary of the most recent security assessment (subject to NDA). Contact hello@geoscript.ai.

Detection and response

GeoScript monitors platform activity, access logs, and infrastructure alerts for anomalous behavior. Confirmed security incidents are escalated immediately and managed under GeoScript's internal incident response plan.

Breach notification

In the event of a confirmed personal data breach affecting customer data, GeoScript will notify affected customers within 72 hours of becoming aware of the incident. Notification includes: the nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken or planned to address it. Where required by law (GDPR Article 33), GeoScript will also notify the relevant supervisory authority.

Post-incident review

Following any significant security incident, GeoScript conducts a post-incident review to identify root cause, assess impact, and implement corrective measures to prevent recurrence.

GDPR

GeoScript's data practices are designed to comply with the EU General Data Protection Regulation (GDPR). We maintain a Data Processing Agreement (DPA) for EU/EEA customers and use Standard Contractual Clauses (SCCs) for cross-border data transfers. EU data subject rights (access, deletion, portability, objection) are honored within 30 days. See our DPA and Privacy Policy.

CCPA / US State Privacy Laws

GeoScript complies with the California Consumer Privacy Act (CCPA) as amended by the CPRA, and applicable US state privacy laws (Virginia CDPA, Colorado CPA, Texas TDPSA, and others). We do not sell or share personal information. California and other applicable residents may exercise their privacy rights by emailing hello@geoscript.ai.

Subprocessor security

All subprocessors that handle customer personal data or Signal Data are evaluated for security posture before engagement. GeoScript maintains data processing agreements with each subprocessor. The full subprocessor list is published in the Data Policy.

No training on customer data

GeoScript does not use customer account data or individually attributed report data to train AI models. AI engine queries run by GeoScript for visibility monitoring use only business name, city, and industry identifiers — no customer personal data.

SOC 2 Readiness

GeoScript is building toward SOC 2 Type II certification. Our security controls are designed to satisfy the AICPA Trust Services Criteria (Security, Availability, Confidentiality). Enterprise customers requiring a current controls summary or security questionnaire response may contact us directly at hello@geoscript.ai.