Security
Visqio is built to keep every organization’s data separate and private, with strict isolation, encryption and audit logging.
Agencies keep many clients' Search Console data in one place. These are the facts about how Visqio protects it — no certifications are claimed that Visqio does not hold.
Organization privacy
- Isolation model
- Organization-scoped repositories
- Every query is constrained to the caller's organization; inserts take organization_id from the session scope, never from input.
- Cross-organization ids
- Resolve to 404
- Unknown or foreign identifiers are indistinguishable from missing ones.
- Roles
- Visqio System Administrator, Brand Administrator, SEO manager, Analyst, Client, Viewer
- Explicit create/read/update/delete/execute matrix per resource; client-pinned members see one client only.
- Sign-up
- Invite-only
- No self-service registration; invitations expire after 7 days and are single-use.
Encryption
- Google refresh tokens
- AES-256-GCM at rest
- Versioned ciphertext with key rotation support.
- Passwords
- argon2id
- Minimum 12 characters, breach-list and strength checks.
- Transport
- TLS via Cloudflare
- HSTS preload, origin certificate between Cloudflare and the server.
- Session tokens
- Random, stored hashed
- Only a SHA-256 hash of the session token is stored.
Two-step verification
In Account, enable two-step verification with an authenticator and store the ten one-use recovery codes securely. They are displayed once. Enabling or disabling verification signs out other sessions. Once enabled, login requires a code and sensitive provider/permission changes require a verification from the past 15 minutes. Password reset preserves two-step verification. Before accepting an invitation to an existing protected account, sign in normally.
Audit and sessions
- Audit log
- Every mutation
- Actor, action, resource, before/after state, IP, user agent and request id — append-only.
- Session revocation
- Per session and all sessions
- Users can end other sessions; admins can revoke a user's sessions; password reset revokes all.
- Rate limiting
- Sliding window per IP and per account
- Login, password reset and invite requests fail closed if the limiter is unavailable.
- Headers
- CSP with per-request nonce
- Plus X-Frame-Options DENY, nosniff, strict referrer policy.
Brand protection
- Phishing watch
- Look-alike host detection on brand SERPs
- Candidates are classified with evidence, never auto-reported.
- Evidence capture
- Screenshots and headers
- Stored outside the web root and served only to authorised members.
- Test sites
- Identical content for every user agent
- No cloaking code path exists; content is re-validated before every render.
Responsible disclosure
If you believe you have found a security issue in Visqio, email security@visqio.com with steps to reproduce. Please do not access data that is not yours, and give us reasonable time to fix the issue before disclosing it. We acknowledge reports within a few business days.
Personal data handling is described in the Privacy Policy.
Request an invite
Tell us about your team and use case. We review every request manually.