OLAB Assist Sign in
Legal

Security

Last updated: October 2026

OLAB Assist is designed to process as little personal data as possible and protect the data it does process. This page explains our security practices. For details of what we collect and why, see the Privacy Policy.

1. Infrastructure

  • The application, its database (Cloudflare D1) and its file storage (Cloudflare R2) are hosted on Cloudflare.
  • Data is encrypted in transit with TLS and at rest with AES-256.
  • The site and API are served exclusively over HTTPS, with HTTP Strict Transport Security (HSTS).
  • Cloudflare maintains SOC 2 Type II reports and ISO/IEC 27001 certification for its platform.

2. Sign-in and team access

  • Google Firebase Authentication handles sign-in through Google, Apple, or email using either a password or a sign-in link. We never see or store passwords.
  • Account deletion requires a recent sign-in and confirmation through a message sent to the account’s email address.
  • Each team has an owner and members. Only the owner can remove sites or markets, invite people, connect integrations, manage billing or delete the account.

3. Connected services and API

  • Google Analytics and Google Search Console connections have read-only access. The long-lived connection token is stored encrypted with AES-GCM using a key held as a server secret. Short-lived access tokens are never stored. Disconnecting a service, removing its site or deleting the account revokes our access at Google.
  • Notion connection tokens are encrypted and stored in the same way.
  • API keys are displayed only once, when created. We store only their SHA-256 hashes.
  • Webhooks are signed with HMAC-SHA256 so your systems can verify that requests came from us.

4. Payments

Paddle processes payments as the merchant of record. You enter your card details directly with Paddle. We never see or store card numbers.

5. AI providers

  • To track AI answers, we send your question text to the AI services listed in the Privacy Policy. We do not include your name, email address or account details with these requests.
  • We access these services through their APIs. Response storage is disabled for our OpenAI requests.
  • The brand facts you add are shared only with the service that checks AI answers against them, as described in the Privacy Policy.

6. Data retention and deletion

  • When you delete your account in Settings, your sites, questions, competitors, AI answers and history are deleted immediately.
  • AI answers older than 90 days are moved to encrypted archive storage. They are deleted when the associated question, site or account is deleted.
  • We retain anonymous counts of how often AI assistants cite public websites. These counts contain no questions, answers, brand names or account details. For all data retention periods, see the Privacy Policy.

7. Our crawler

Our crawler, OLABAssistBot, audits your site. It reads only public pages, follows robots.txt and never signs in to a site. For free audits, we store only a salted hash of the visitor’s IP address to limit abuse.

8. Current limitations

We do not yet have our own SOC 2 report or ISO/IEC 27001 certification, and SAML single sign-on is not available. Contact us if your organization needs a data processing agreement or a completed security questionnaire.

9. Reporting a security issue

If you believe you have found a vulnerability, email [email protected] with “Security” in the subject line and enough detail for us to reproduce it. Please allow us a reasonable time to fix it before public disclosure. We do not take legal action against good-faith security research that respects our users’ data.