Security
Last updated: July 22, 2026
Keeping your data safe is fundamental to Rank Monster. This page summarizes the practices and infrastructure we use to protect the information you trust us with at rankmonster.ai.
Infrastructure
- Managed cloud hosting — the application runs on Vercel and our database on Neon (Postgres), both operated in SOC 2–compliant data centers with automated patching and redundancy.
- Edge protection — traffic is fronted by Cloudflare, which provides DDoS mitigation, a web application firewall, and automated bot filtering.
- Isolation — customer data is logically separated at the database layer and scoped per account (and per team workspace) on every request.
Encryption
- In transit — all connections to rankmonster.ai are encrypted with TLS 1.2+ (HTTPS). HTTP is redirected to HTTPS.
- At rest — data stored in our database and object storage is encrypted at rest by our infrastructure providers.
- Secrets — API keys and credentials are stored as encrypted environment variables and are never committed to source control.
Authentication & access
- Sign-in uses passwordless magic links or Google OAuth. When passwords are used they are stored only as salted hashes — never in plain text.
- Sessions are time-limited and can be revoked from your account settings.
- Internal access to production systems is limited to authorized personnel on a least-privilege basis.
Payments
All payments are processed by Stripe, a PCI-DSS Level 1 certified provider. Rank Monster never sees or stores your full card number — card data is sent directly to Stripe.
Subprocessors
We rely on a small set of vetted subprocessors (hosting, database, payments, email, and AI provider APIs) to deliver the service. The current list is maintained in our Privacy Policy, and our data-processing commitments are described in our Data Processing Agreement.
Data retention & deletion
You can request deletion of your account and associated data at any time. After deletion, residual copies may persist in encrypted backups for up to 30 days before being permanently removed.
Responsible disclosure
If you believe you have found a security vulnerability, please report it to us privately at [email protected] before disclosing it publicly. We investigate all legitimate reports and will work with you to resolve valid issues promptly. Please do not run automated scans that degrade service for other users.
Contact
Questions about our security practices? Email [email protected].