Security
A plain description of how we protect your account and data.
Last updated: November 10, 2026
Accounts and access
- Passwords are stored as salted hashes, never in plain text.
- Email addresses must be verified before an account can sign in.
- Sign-in, sign-up, and password reset are rate limited.
- Resetting your password signs out every other session.
- Every API route checks that you own the workspace you are reading or changing.
Data protection
- All traffic uses HTTPS with HSTS. Pages ship a strict Content Security Policy.
- API keys are stored only as SHA-256 hashes.
- WordPress application passwords are encrypted with AES-256-GCM.
- Outgoing webhooks are signed (HMAC-SHA256) and can only target public https addresses.
- Server-side fetches of customer websites are restricted to public https addresses.
Subprocessors
These services process data on our behalf:
- Vercel: Application hosting
- Neon: Database (PostgreSQL)
- Trigger.dev: Background jobs (weekly scans)
- Cloro: Collecting AI engine answers for your prompts
- TokenRouter: Language-model API for analysis and drafts
- Dodo Payments: Payments and subscriptions (we never see card details)
- Resend: Transactional email
- Google: Optional sign-in with Google
- Pexels: Stock images for drafted articles
Reporting a vulnerability
Found a security issue? Email hello@analytise.com with the details. Please give us a reasonable time to fix it before disclosing it publicly.