Security at GEOFast

What isn't in place yet

• No SOC 2 report. GEOFast has not been audited. The providers below have their own reports, which cover their systems and not ours.
• No single sign-on. There is no SAML or OIDC sign-in for a company's own identity provider. It is the first thing we would add: write to us if you need it to buy.
• No two-step sign-in. An account is as safe as the Google account or the inbox behind it.
• No outside penetration test. Nobody outside GEOFast has been hired to attack it.

Signing in

You sign in with Google or with a one-time code sent to your email, through Clerk. Passwords are switched off, so there is none to store.

Payments

Stripe takes your card and keeps it, on its own pages. GEOFast never sees the card number: we keep your plan, its status, Stripe's ids for you and, so each card gets one free trial, the card's fingerprint (Stripe's code for a card, not its number).

What is stored, and how

• Your team's data (projects, prompts, the answers AI assistants gave, uploads) is shown only to your team's members: every request is checked against your sign-in and limited to your team, and there is no admin screen. Two exceptions: a report you share by its link, and a site's X-ray, which is built from public pages and opens for anyone with its link. The AI providers named in the privacy policy receive the prompts, answers and files they work on. We can reach the database, and read your data only if you ask, to keep the service secure, or because the law requires it.
• Google access. If you connect Search Console, the access is read-only, and the token Google gives us is stored encrypted (AES-256-GCM) and never sent to a browser. Disconnecting deletes it and asks Google to revoke it, unless the same Google account is still connected in another team.
• Agent keys. A key a coding agent uses over MCP is stored as a hash, so the key itself can't be read back. For an app you connect by signing in, such as ChatGPT or Claude, we never store its tokens.
• IP addresses. Our own database keeps a salted hash of a visitor's address, never the address, to limit how many scans, checks and downloads one visitor can run. Providers that serve the request see the address itself: Vercel, Clerk for a signed-in session, PostHog to count visits, and the ad platform whose ad brought you, when you started an X-ray or signed up and allowed it.
• No ad platform's cookies, pixels or scripts, and no analytics cookies. Usage is counted without cookies or anything kept in your browser. Signing in sets Clerk's session cookies, and small cookies of ours remember how you like to do fixes, whether the sidebar is folded, whether the bar that says no plan is running shows, and, where you allow it, which of our links or ads brought you.

The full list of what we collect, who handles it and how long we keep it is in the privacy policy.

Where it lives

GEOFast runs on other companies' systems. Each of these says on its own page that it holds a SOC 2 report:

• Vercel hosts the site and runs its functions.
• Neon hosts the database.
• Clerk runs sign-in and accounts.
• Stripe takes payments.
• Resend sends our emails.

The privacy policy names the rest, with the AI providers that read pages, questions and answers.

What you control

• A team can download its settings, dashboards, prospects and every project's history from the dashboard.
• Deleting your account removes your sign-in details at once, and with them a team only you are in: its projects and their data are removed and its plan cancelled. Invoices and payment records stay for five years, as Polish tax law requires.
• Agent keys and connected apps can be revoked from the dashboard at any time.

Report a problem

If you find a weakness in GEOFast, write to legal@trygeo.fast with what you did and what you saw. We read every report. Please don't open anyone else's data or disrupt the service while you test.