Security & Trust

Security at Vizzybl

We monitor how your brand shows up across AI answer engines. Protecting the data you trust us with is foundational to how we build.

GDPR compliant, independently assessed
SOC 2 Type II audit in progress
Annual third-party penetration tests
Encrypted at rest (AES-256) and in transit (HTTPS)
Data storage in the US, EU or Asia Pacific
Never sold, never shared to train AI models

Visit our Trust Center Security documents

Independently assessed by a third-party auditor.

Independent audit under way. Report on our Trust Center once issued.

Self-assessment completed.

Documents

Everything your security review needs

Our policies, contracts and subprocessors, in one place.

Your data

Privacy and ownership

Your data is yours. Here is what that means in practice.

We never sell your dataYour brand data, prompts, and results are never sold or rented to anyone — full stop.

We don't share your data to train AI modelsYour prompts are sent to AI providers solely to generate responses — for inference, never to train their models.

Your data is isolated to your tenantEvery customer's data lives in its own tenant, and access is checked on every request — so one customer can never see another's.

We keep only what we needWe store the minimum required to run your monitoring, and internal processing errors are never surfaced as your data.

Infrastructure

Built on hardened cloud infrastructure

Google CloudVizzybl runs on Google Cloud, inheriting its physical, network, and platform security controls.

Encrypted at restAll stored data is encrypted at rest with AES-256 by default.

Encrypted in transitEvery connection is encrypted in transit over HTTPS, with HSTS enforced — no unencrypted traffic.

Connected accounts encryptedCredentials for connected services like Search Console and analytics are individually encrypted with AES-256-GCM using managed keys.

Hardened web securityA strict Content-Security-Policy, anti-clickjacking, and other defense-in-depth headers protect every page.

Abuse protectionRate limiting and bot/abuse detection guard public endpoints against automated attacks.

Access control

Identity and access

Sign in with GoogleAuthentication is handled by Firebase Authentication with Google sign-in — we never store your password.

Multi-factor authenticationAdd an extra layer of protection with authenticator-app MFA (TOTP).

Instant session revocationAccess can be revoked within seconds — sessions don't linger after permissions change.

Least-privilege accessAccess to your workspace is membership-verified on every request, not assumed from a single login.

Scoped automationEach automated agent runs with least-privilege access limited to a single customer's data, and only for the task it is performing.

Compliance

Data residency and compliance

Where your data is stored, and the standards we are assessed against.

Choose your regionChoose where your data is stored — the United States, the European Union, or Asia Pacific.

GDPR compliantOur GDPR compliance has been independently assessed by a third-party auditor, and our Data Processing Agreement sets out how we handle personal data for you.

SOC 2 Type II audit in progressAn independent auditor is testing how our security controls operate over time. The report will be available through our Trust Center once issued.

Annual penetration testsAn independent third party tests Vizzybl for security weaknesses every year.

Audit loggingAdministrative and authentication activity is logged and retained for 7 years; IP addresses are hashed, not stored in the clear.

Security FAQ

Straight answers to the questions we hear most.

We're GDPR compliant, independently assessed by a third-party auditor. Our SOC 2 Type II audit is in progress with an independent auditor, and we've completed an EU AI Act self-assessment. The current status of each is on our Trust Center. We also have an independent third party run a penetration test every year.
Visit our Trust Center
Our security policies and controls are on our Trust Center, where you can also request our security questionnaire. Our SOC 2 Type II report will be available there once the audit is complete.
Visit our Trust Center
Yes. An independent third party carries out a penetration test of Vizzybl every year.
Yes. Our GDPR compliance has been independently assessed by a third-party auditor. Our Data Processing Agreement sets out how we process personal data on your behalf, you can choose EU data storage, and we've completed an EU AI Act self-assessment.
Read our DPA
We never sell your data, and we never share it with AI providers to train their models — your prompts are sent only to generate responses. How we may use data to improve Vizzybl's own service is described in our Privacy Policy.
Read our Privacy Policy
Yes. You choose your storage region at setup — United States, European Union, or Asia Pacific — and that choice determines where your data is held at rest. Processing may also take place in the countries where we and our subprocessors operate, which are listed in our Data Processing Agreement.
See our subprocessors
They're listed in Annex III of our Data Processing Agreement, with each one's purpose, location and transfer safeguard. We give at least 30 days' notice before adding or replacing one.
See our subprocessors
Every customer has its own tenant, and access is verified on every request. There is no shared view across tenants, so one customer can never reach another's data.
Yes — at rest with AES-256 and in transit over HTTPS. Credentials for connected accounts get an additional layer of AES-256-GCM encryption.
Sign-in is handled by Firebase Authentication with Google sign-in, and you can enable authenticator-app multi-factor authentication (TOTP) for an extra layer.
We send your prompts to AI providers solely to generate responses (inference). On their API tiers, that data is not used to train their models, and connections are encrypted in transit.
You can export your content at any time while your subscription is active. When your agreement ends we delete or return your personal data, as you choose, and otherwise delete it within 30 days. Copies in our backups are removed on a fixed rolling cycle, set out in clause 9.3 of our Data Processing Agreement.
Read our DPA
If a personal data breach affects your data, we'll notify you without undue delay and within 72 hours of becoming aware of it, with the information you need for your own notifications. The commitment is in clause 7.2 of our Data Processing Agreement.
Read our DPA
Send it to us through our support form and we'll route it to the right people promptly.
Contact support

Need more for your security review?

Our Trust Center has our policies, controls and security questionnaire. For anything else, talk to our team.

Visit our Trust Center Talk to our team