Security
How CiteSonar handles your site, your Google access and your data, and how to report a vulnerability.
Read-only by design
CiteSonar never writes to your site. It drafts the change, you apply it, and we read your page to check it went live.
Google access
Connecting Google asks for two read-only scopes: webmasters.readonly for Search Console and analytics.readonly for Google Analytics. Neither lets CiteSonar change anything in your Google account, and you can disconnect at any time.
Tokens encrypted at rest
The Google access and refresh tokens you grant are encrypted before they are stored, with a key kept outside the database. A copy of the database alone does not hold them in readable form.
Export and deletion
You can export your data and delete your workspace yourself, with no email to us first.
Report a vulnerability
To report a vulnerability, write to the address below. Say which page or endpoint is affected and how to reproduce what you found.