Data and security

SimplyRank takes your data seriously. Here's what we do to protect it, and what you can expect from us.

For the legal version, see our Privacy Policy and Terms of Service.

What we store

Three categories:

Category	Examples
Account data	Your email, name, organization name, sign-in activity
Configuration data	The brands, prompts, competitors, categories you've set up
Scan data	The AI responses we capture, mentions detected, citations parsed, position and sentiment scores

We don't store your card details. Stripe handles payment data; we receive a customer ID and subscription status only.

Where it's stored

Application database: Supabase (PostgreSQL) on AWS, in Zurich, Switzerland. This is where your account, configuration and scan data live, on every plan.
Hosting: Vercel (for the web application).
Monitoring: Sentry (for error tracking).
Email: Resend (sign-in emails, notifications and product emails).
Billing: Stripe.

Each provider receives only the data it needs for its role. The AI model providers we query (OpenAI, Anthropic, Perplexity and Google) receive your prompts. Some processing happens outside Switzerland, including in the United States. More providers are listed in Privacy and GDPR.

How it's protected

Encryption in transit: All requests use HTTPS / TLS.
Encryption at rest: Database and backups are encrypted by the cloud provider.
Access controls: Production access is limited to the people who run SimplyRank.
Row-level security: Multi-tenant isolation in the database — your data is logically partitioned and queries can't cross-tenant.
Authentication: Handled by Supabase Auth. You sign in with a one-time code we email you. A password is optional, and you can set one in Settings → Profile.
Error monitoring: Application errors are reported to Sentry so we can fix them.

Multi-tenancy

SimplyRank is multi-tenant — many organizations share the same application. We enforce strict isolation at the database level using row-level security policies. Your queries only return your own data; another tenant cannot see your prompts, brands, or scan results.

Data retention

How long we keep your data:

Data type	Retention
Scan history	For as long as your workspace exists. We don't delete it automatically, whatever your plan
Account data	For as long as your workspace exists, including after you cancel. Deleted when you ask us to delete your account, unless the law requires us to keep it
Billing records	As long as tax and accounting law requires
Error reports and request logs	For a limited period set by our providers, then deleted

History is the same on every plan: we keep all of it until the workspace is deleted, and the dashboard shows up to 365 days at a time. To delete your data, see Deleting your account.

Data we don't use for AI training

To be clear: we do not train AI models on your data. Your scan results, prompts, and brand data are not used to train any model — ours, OpenAI's, Anthropic's, or anyone else's. The AI models we query are accessed via standard APIs that don't permit them to retain your input for training (per provider terms).

Security incidents

If we discover a security incident affecting your data, we will:

Investigate immediately.
Contain and remediate.
Notify affected customers without undue delay where the law requires it.
Provide enough detail for you to assess your own obligations.

We hope to never need to send this kind of notice. We've designed the product to make it as unlikely as possible.

Compliance

GDPR and UK GDPR: If you're in the EEA or UK, you have the rights set out in Privacy and GDPR. Email [email protected] to use them.
CCPA: California residents have rights described in our Privacy Policy.
SOC 2: SimplyRank itself isn't SOC 2 certified. Some of the underlying providers we use (Supabase, Vercel, Stripe) have their own SOC 2 attestations.

For specific compliance questions, email [email protected].

What you can do to keep your data safe

A few things on your side:

Sign-in emails: Don't share or forward them. The link and the code inside are single-use sign-in tokens — anyone who has one can sign in as you.
Email security: Sign-in codes and password resets all go to your inbox, so keeping your email account secure (strong password, MFA) is important.
Your password: If you set one for SimplyRank, don't reuse a password from anywhere else.
Team membership hygiene: Remove team members who leave the company.