Sources on every finding
Each finding is marked measured or inferred and names where it came from. Anything unchecked is marked unchecked.
Trust
Where your data goes, read from the code.
13 services. Each one is called by the code, and each is listed with the module that calls it.
How we handle claims
Three rules the product follows.
Competitors are read, never contacted
A report reads the public pages of the competitors you name. It does not email, message or call them.
Connections you control
When you connect an account, the authorisation is held by Pipedream, not by us. We hold an opaque id and call the account through their proxy.
Third parties
Every service the product calls.
Taken from the codebase on 13 October 2026. When a service is added or removed, this list changes with it.
- Fly.ioHosting and the Postgres database
- Everything the application stores: reports, accounts, orders and run records. The app's primary region is London.
fly.toml · src/lib/supabase.ts - TigrisFile storage for report PDFs
- Generated report files, served to you through signed links.
src/lib/storage.ts - SupabaseLegacy database and storage path
- Only used when the main database is not configured; production runs on Fly Postgres.
src/lib/supabase.ts - AnthropicLanguage model (Claude)
- Text from the public pages being read, and the instructions for reading them.
src/lib/llm.ts - OpenRouterLanguage model routing
- The same kind of text as above, when a run is routed through it.
src/lib/openrouter.ts - FirecrawlFetching web pages
- The public website addresses being read: yours and the competitors you name.
src/lib/firecrawl.ts - Google (PageSpeed Insights, Places)Page speed and business listings
- Public website addresses, and business names or locations to look up.
src/lib/connectors/pagespeed.ts · src/lib/connectors/places.ts - DataForSEOSearch demand data
- Keywords and public domains.
src/lib/connectors/dataforseo.ts - SpyFuPaid and organic search data
- Public domains.
src/lib/connectors/spyfu.ts - Companies HouseUK company register
- Company names and numbers to look up in the public register.
src/lib/connectors/companies-house.ts - ResendEmail delivery
- Your email address and the email we send you.
src/lib/email/client.ts - StripePayments
- What you buy and your payment details, entered on Stripe's own page. Card details never reach our servers.
src/lib/stripe.ts - PipedreamConnecting your accounts (for example Google Analytics)
- Your authorisation, held at Pipedream. We store only an opaque connection id and call your account through their proxy.
src/lib/connect/pipedream.ts
Security
What is true today.
- Cookies are first-party and strictly necessary; no analytics or advertising script is loaded. The full list is on the privacy page.
- A report link is a bearer link: anyone holding it can read that report. Keep it private.
- Vendor keys are held as deployment secrets, never in the code repository.
- We hold no security certification today.
FAQ
Trust questions
Is this a formal sub-processor list?
Not yet. It is the list of services the code calls, read from the code. Retention periods, a formal sub-processor list and our position on international transfers are not published yet; the privacy page records the same gap.
Who can see my report?
Anyone who has its link. A report link is a long random token that works without signing in, so treat it like a password: do not paste it anywhere public.
Are you certified?
No. We hold no security certification today.
Can I have my data deleted?
Yes. Use the contact form and a person will answer, including requests to see or delete what we hold.