How Cited handles your business data

1. Where your data lives

Cited runs on a small number of providers. The full list, with what each one receives and where, is on our subprocessor list.

• App and server code: Vercel, in its US East region (Washington, D.C.). Public pages are also cached on Vercel's worldwide edge network.
• Database and sign-in: Supabase, in the United States. Your account, businesses, scans, reports and fix progress live here.
• Payments: Stripe. Card details go straight to Stripe; we never see or store a full card number.
• Email: Resend, in the United States, for reports, sign-in links and the email you agreed to.
• Support chat: Crisp, in the European Union, only if you use chat.
• Backups: an encrypted copy of the database each night, kept about 35 days.

Most of this is outside Canada. While it is there it is protected by contract, and it can be reached by courts and authorities of that country under its laws.

2. What we read

• Your public website, and only that. A scan reads your home page, your robots.txt and up to 5 more public pages on the same site that look like services, locations, about or pricing. It sends no cookies, never signs in and never fills in a form.
• It identifies itself. Requests carry the user agent CitedBot/1.0 (+https://cited.aaronmorais.com/methodology), follow your robots.txt and stop if you block it. Addresses on private or internal networks are refused.
• AI answers about your market. We ask ChatGPT Search, Gemini and Google AI Overviews the questions in your report, through our search-data provider. The questions contain your business name, category and market, never your email address.
• Public business listings that appear in those answers or in search results, the same pages anyone can open.

3. What we never do

• We never ask for your passwords. Not for your website, your Google Business Profile or anything else. If someone claiming to be us asks, it isn't us.
• We never publish anything for you. Fixes are copy-ready drafts. You, or your web person, decide what goes live. Cited has no access to your site, listings or social accounts.
• We never sell your data or use it for ad targeting. Analytics and ad measurement stay off until you allow them.
• We never put your report on search engines. Report links are long and random, and they are marked not to be indexed. Anyone you share a link with can see that report, so share it with care.

4. How long we keep it, and deleting it

We keep your account and reports while your account is open. Free reports are deleted 24 months after the last scan or visit, and closed accounts after 24 months without a sign-in. Signed in, Settings lets you download a machine-readable copy of your data or delete your account and reports yourself, right away. Backups expire about 35 days later. Billing records stay for tax law, without your name or email. Every period is in our privacy policy.

5. Encryption

• Every page and API call uses HTTPS, and browsers are told to accept nothing else (HSTS).
• Our database provider encrypts stored data at rest.
• Nightly backups are encrypted before they are stored, and the key to read them is kept apart from the backups.
• API keys and secrets live in our host's encrypted settings, never in our code. CI checks that none reach the browser.
• Payment notifications from Stripe are signature-checked before we act on them.

6. Who can see your data

• You: every table has row-level security, so a signed-in customer can read only their own businesses and reports.
• Us: Cited is two founders. Only they can reach production systems. Admin tools open only for the owner's confirmed email address, checked on the server on every request.
• Our providers: each receives only what its job needs (see the subprocessor list), under its own contract.

7. Uptime and incidents

Our status page shows live health for scans, AI engines, the dashboard and billing, and incidents from the last 30 days. Automated checks run every 15 minutes, a full sign-up and report test runs against production every 12 hours and after every release, and we restore a backup into a test database every week to prove it works.

If personal information is ever lost, accessed or disclosed without authorization, we record it in our incident register, assess the risk, and contain it. Where there is a real risk of serious harm we tell the people affected and the Privacy Commissioner of Canada, and for Quebec residents the Commission d'accès à l'information, as the law requires.

8. Report a vulnerability

Found a security problem? Email morais.aaron@gmail.com with “Security” in the subject. Include the steps to reproduce it. We reply within two business days and keep you posted until it is fixed. Our security.txt file has the same details.

Please test only against your own account and data, never read or change someone else's, and don't run load tests or automated scans that start real scans: each one costs us money. We have no paid bug bounty yet, but we will credit you if you'd like.

9. What we don't have (yet)

We are a small company. We have no SOC 2, ISO 27001 or other security certification, and no third-party penetration test yet. Several of our providers hold their own certifications; their pages are linked from the subprocessor list. If your business needs a security questionnaire answered, email us and we will answer it honestly.