Where your data lives

RankBull is licensed software, not a hosted data service. The backend runs on a Convex deployment you own. Your sites, articles, keyword research, tracking results, provider API keys, and CMS credentials are stored there — on your infrastructure, under your account, in the region your Convex account uses.

We operate two things: the shared frontend at rankbull.io, and a small license registry that records who owns a license and which deployment it points at. That registry holds your email, license key and tier, deployment address, an encrypted Convex deploy key, and install status. Nothing else. Details are in our Privacy Policy.

Encryption

Traffic between your browser, our website, and your deployment uses TLS 1.2+.
Secrets (provider API keys, OAuth refresh tokens, signed-webhook secrets) are encrypted at rest with AES-256-GCM before they are written to your deployment.
The Convex deploy key you hand us at setup is sealed with AES-256-GCM; the master key that opens it lives with the installer, never on the public web server.
Public webhook deliveries are HMAC-SHA256 signed with your secret. Verify via X-Pulse-Signature: sha256=....

Authentication

Email and password sign-in, with an optional emailed sign-in link. Passwords are hashed; plaintext passwords are never stored.
Role-based access control (owner, admin, editor, viewer) scopes every workspace action.
The license sold on this site is unlimited — workspaces, sites and team members are uncapped. Nothing is feature-gated.

Methodology + transparency

The tracker math (Visibility Score weights, sentiment classifier prompt, K-resample logic, Wilson CIs) is published in our methodology page. Raw engine responses are kept in your deployment so you can audit any individual citation, and how long you keep them is your call.

Subprocessors and the DPA

The providers we use to run the website and the license registry are listed at /legal/subprocessors. The AI and SEO providers the software calls are reached with your own API keys from your own deployment — they are your providers, not ours.

Our Data Processing Addendum explains the split: you are the controller for everything in your deployment, and we process only the license registry data. Email support@rankbull.io if you need it signed.

Disclosures

We hold no third-party security certification. We are a small team, and we would rather say so than imply otherwise.
We do not scrape ChatGPT or Gemini consumer UIs. Google AI Overviews data is sourced via DataForSEO under your own DataForSEO account.
LLM responses are non-deterministic; we surface K-resample counts + Wilson 95% CIs so you see the uncertainty honestly.
We don't fuzzy-match brand names: fewer false positives, and you can extend matching with aliases.
Securing your own deployment — your Convex account, your deploy key, your provider keys — is your responsibility. We cannot recover them for you.