Security
Visqio is built as a multi-tenant platform with strict isolation, encryption and audit logging.
Agencies keep many clients' Search Console data in one place. These are the facts about how Visqio protects it — no certifications are claimed that Visqio does not hold.
Tenant isolation
- Isolation model
- Organization-scoped repositories
- Every query is constrained to the caller's organization; inserts take organization_id from the session scope, never from input.
- Cross-tenant ids
- Resolve to 404
- Unknown or foreign identifiers are indistinguishable from missing ones.
- Roles
- SUPER_ADMIN, ADMIN, SEO_MANAGER, ANALYST, CLIENT, VIEWER
- Explicit create/read/update/delete/execute matrix per resource; client-pinned members see one client only.
- Sign-up
- Invite-only
- No self-service registration; invitations expire after 7 days and are single-use.
Encryption
- Google refresh tokens
- AES-256-GCM at rest
- Versioned ciphertext with key rotation support.
- Passwords
- argon2id
- Minimum 12 characters, breach-list and strength checks.
- Transport
- TLS via Cloudflare
- HSTS preload, origin certificate between Cloudflare and the server.
- Session tokens
- Random, stored hashed
- Only a SHA-256 hash of the session token is stored.
Audit and sessions
- Audit log
- Every mutation
- Actor, action, resource, before/after state, IP, user agent and request id — append-only.
- Session revocation
- Per session and all sessions
- Users can end other sessions; admins can revoke a user's sessions; password reset revokes all.
- Rate limiting
- Sliding window per IP and per account
- Login, password reset and invite requests fail closed if the limiter is unavailable.
- Headers
- CSP with per-request nonce
- Plus X-Frame-Options DENY, nosniff, strict referrer policy.
Brand protection
- Phishing watch
- Look-alike host detection on brand SERPs
- Candidates are classified with evidence, never auto-reported.
- Evidence capture
- Screenshots and headers
- Stored outside the web root and served only to authorised members.
- Test sites
- Identical content for every user agent
- No cloaking code path exists; content is re-validated before every render.
Responsible disclosure
If you believe you have found a security issue in Visqio, email security@visqio.com with steps to reproduce. Please do not access data that is not yours, and give us reasonable time to fix the issue before disclosing it. We acknowledge reports within a few business days.
Personal data handling is described in the Privacy Policy.
Request an invite
Tell us about your team and use case. We review every request manually.