Home / Security
Your site data stays under your control
Google access is read only, connected tokens are encrypted, crawl traffic is paced, and exports remain available. Review the safeguards before connecting a property.
You authorize access from Google and we request the smallest practical scope
Connecting to Search Console or GA4 never means that you give us a password. The entire process runs through Google, and what we ask for is deliberately narrow.
Google's own consent screen
Both Search Console and GA4 connect via Google's OAuth flow. They review the request and approve it in Google, so the permission granting occurs on Google's side, not ours. We never review or store your Google password.
Read-only areas only
We ask for read-only access. Swiss Knife SEO interprets the performance data it needs to connect to your crawl, and nothing in the connection allows us to change the settings in your Google Properties.
Encrypted and you can revoke it
The tokens returned by Google are stored encrypted at rest. You can disconnect or delete a website at any time, including revoking access through your own Google Account.
Self-hosted in Europe, with artifacts behind ephemeral links
Your reports and exports are not spread across a range of third-party services. They live from the infrastructure we operate in one place.
European self-hosted infrastructure
Swiss Knife SEO runs on a self-hosted infrastructure in Europe. Your site scans, saved reports and account data reside on servers we operate directly, rather than across a chain of managed providers.
Private object storage, signed access
Crawl artifacts, the workbooks and exports that a crawl produces, are kept in private object storage. They are only accessible via short-lived signed links, so there is no permanent public URL to guess, index, or forward forever.
A crawler that stays polite and stays within the approved scope
A crawler that ignores the rules is a danger. Our server respects the boundaries of the websites visited and protects your servers during operation.
Respects robots.txt on sites you have not reviewed
Point the crawler to a website you don't own, for example to look at a competitor, and it will consider that website's robots.txt. It stays within the rules that the website publishes.
Requires proof before overwriting your own robots.txt.
Overriding robots.txt is only available on sites where you have verified ownership. On your own verified property you can crawl past a block, but nowhere else.
Paces requests and backs away under pressure
The crawler moves at a reasonable pace and slows down when a server shows signs of overload, allowing an audit to let you know about a website without taking it down.
Validates each retrieval based on internal address protection
Every request made by the crawler is first checked against internal address protection, so the crawler cannot be tricked into reaching private or internal network addresses.
Secrets are encrypted at rest and only shown to you once
The credentials you create in Swiss Knife SEO are treated as secrets, not as convenient strings we keep lying around.
Once displayed, only a fingerprint remains
API tokens and log capture tokens are presented to you once, the moment you create them. After that, we only keep their SHA-256 digest, a one-way fingerprint. We cannot view the original token again because we no longer own it. If you lose one, create a new one.
- API tokens: SHA-256 digest only
- Log Ingestion Tokens: SHA-256 digest only
- Once revealed at creation, never shown again
Connected account token encrypted with a rotating key
Connected account tokens are encrypted with a key that can rotate separately from the data it protects. This separation means the encryption can be updated without affecting everything else, which is a standard part of good key hygiene.
- Encrypted at rest, not stored in plain text
- Key can be rotated independently
- Applies to your Google and other connections
It's clear what AI is being used and it's easy to move away from it
Two things are asked most often: what happens when a function calls an AI model and whether they can take their data with them. Both answers are clear.
AI tasks use disclosed third party model providers
When a feature uses AI, it calls on measured third parties to perform the work. This usage is visible in your workspace, so the AI is never a black box hidden from view. You can see how it is spent.
Your data is portable at any time
Export each report to an XLSX workbook, CSV, a printable PDF, or drag and drop vian API at any time. Whatever you created in Swiss Knife SEO can be preserved in a format that you can actually use.
This page describes in plain language how the product handles your data. The full legal terms and privacy policy can be found in the app: read the Terms and the Privacy Policy for the binding details.
Before you connect anything
Can you access my Google account password?
Where is my crawl data stored?
Can I access my data at any time?
Read the instructions and then try the tool
The free plan allows you to connect a property, do a real audit and see how your data is handled from the inside. No pressure and an export button that always works.