Security and data handling

Short version: the free Findability Score, our Tier 1 Audits, and the Privacy & Tracking Check need no access to your systems. Tier 2 builds and Tier 3 Resident Engineers use scoped access to product data, search/recsys repositories, or tag setup—never to customer or payment data.

Tests that need no access

• Findability Score and Search / Recommendations Audits: we use your public website the way a shopper does: public pages and the public search/recommendation endpoints your pages call. We never log in, add to cart, submit forms or try to get around bot protection.
• The free check’s scanner identifies itself as RankTalos-FindabilityCheck/1.0, follows your robots.txt, sends one request at a time with a pause, and stops at 60 requests. About the scanner.
• AI Findability Evaluate: we ask public AI assistants shopper questions in clean, logged-out sessions and check answers against your public product pages. Merchant Center read access is optional and read-only; we never change your feeds or listings during an Evaluate.
• Privacy & Tracking Check: after you confirm in writing that we may test your store, we load four public pages in a standard browser as three visitor profiles and record the network traffic. We don’t log in, place orders or submit forms. If your bot protection blocks us, we stop and ask you to allowlist our test.
• Search-log exports are optional. If you share one, it is read-only, used only for your report, and deleted when the engagement ends unless you ask us to keep it for a re-test.

Fixes

• Search Fix, advisory: no access needed. Your team or agency makes the changes.
• Search Fix, working solution: a scoped API key or app install that reads products and writes product facts and search settings.
• Privacy Fix: collaborator or staff access limited to themes, apps and preferences, and access to your Google Tag Manager container if you use one. We work on a copy of your theme or a container workspace and you approve before publishing.
• We don’t request access to orders, customers or payments. You can revoke access at any time; we tell you when we are done so you can remove it.

What we store

• Check results: your store’s public product data as used in the result, the requests we ran and what came back. Results are private links, not indexed, and you can turn a link off or delete your account and its results from your account settings.
• Evidence for paid reports: screenshots and network recordings of your public pages, kept for at least two years so findings can be reproduced, then deleted. They contain no data about your customers.
• Your email address, if you sign in, and the details you send in a form. See the privacy policy.

This website

• Served over HTTPS only, with HTTP Strict Transport Security.
• A content security policy that allows scripts and styles only from this site, by hash; no third-party scripts, frames, fonts or images.
• Framing blocked, MIME sniffing off, a strict referrer policy, and camera, microphone, location and payment features turned off.
• Sign-in by emailed link; no passwords stored.

Reporting a vulnerability

Email security@ranktalos.com. See responsible disclosure for what to include and what we promise in return. Our security.txt has the same details.

Questions

Email hello@ranktalos.com. For larger retailers, we answer security questionnaires during procurement. We don’t hold a SOC 2 report or other certification.