Skip to content
MrKeyword
Get started
FeaturesAI SEOPricingFree toolsFAQAboutLoginGet started
Security

What MrKeyword can touch, and what it cannot.

Connecting an SEO tool to your search accounts is a real decision. Here is exactly what MrKeyword asks for, how it stores it, and where the boundaries are — including the places we will not overclaim.

Access

Read scopes, nothing more.

These are the exact OAuth scopes MrKeyword requests. Nothing else is asked for, and nothing beyond these can be used.

OAuth scopes requested by MrKeyword.
ConnectionScopeWhat it allows
Google Search Consolewebmasters.readonlyRead performance data and the list of properties you have verified. It cannot change a property, submit a sitemap or alter your site.
Bing Webmaster ToolsWebmaster.readRead query, page and crawl data for your verified Bing sites.
Google Analytics (optional)analytics.readonlyRead analytics data only, and only if you choose to connect it.
Google sign-in (optional)openid email profileConfirm who you are when you sign in with Google. No access to any Google service data.
Google Keyword Planner (optional)adwordsFetch keyword demand from the Keyword Planner API. Google does not publish a read-only variant of this scope, so we will not describe it as one — connect it only if you want Keyword Planner data.
Storage

How the sensitive parts are kept.

Provider refresh tokens
Encrypted with AES-256-GCM — authenticated encryption with a fresh 96-bit random initialisation vector per record and a verified authentication tag — under a 32-byte server key supplied as APP_ENCRYPTION_KEY. A token that cannot be decrypted is never used: the connection is marked as needing to be reconnected.
Passwords
Hashed with scrypt (N=16384, r=8, p=1) using a unique random salt per password, and compared in constant time. Passwords must be at least 12 characters. The plain password is never stored.
Sessions
The session cookie holds a random token; only its SHA-256 hash is stored server-side. The cookie is HttpOnly, SameSite=Lax and — on any HTTPS deployment — Secure, with a 14-day lifetime.
OAuth state
The state value used during a provider connection is stored hashed, with a 10-minute expiry, so a stale or replayed callback cannot complete.
Isolation

One workspace cannot see another.

Scoped on every query

Every database read and write is filtered on the organisation attached to your session, which itself resolves only through a membership you actually hold.

404, not 403

A site, crawl or report belonging to another workspace returns a 404 — the same answer as one that does not exist — so nothing is leaked by the error message.

Roles inside the workspace

Owner, admin, member and viewer. Write routes declare which roles may call them; a viewer attempting a change is refused.

Scoped AI tokens

An MCP token is read-only and bound to a single workspace, and can be revoked at any time from Settings.

Application hardening

What every response and every fetch does.

Content Security Policy
Every response sends default-src 'self'; connect-src 'self'; style-src 'self'; script-src 'self'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'. There is no unsafe-inline, no inline script, and no third-party script or font origin anywhere in the product or on this website.
Other response headers
X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin and a Permissions-Policy that switches off camera, microphone and geolocation. Every JSON response is sent no-store.
CSRF protection
Every state-changing request must carry the per-session CSRF token in an x-csrf-token header, checked against the session, on top of a SameSite=Lax cookie.
Rate limiting
Ten failed sign-ins per 15 minutes, per IP address and per email address; the same limit on password changes; ten registrations an hour. The public contact form and the free authority checker are rate-limited per IP too.
Crawler safety (SSRF)
Every URL MrKeyword fetches on your behalf is checked before and after DNS resolution and on every redirect hop: HTTP and HTTPS only, standard ports only, no credentials in the URL, and private, loopback, link-local, metadata and reserved addresses refused outright.
Untrusted content
Crawled page content is treated as untrusted and escaped before it is ever rendered in the product.
Scope

What this does not do

Security pages are where SaaS marketing tends to drift. So, plainly:

  • No compliance certifications. MrKeyword does not hold SOC 2, ISO 27001 or any similar attestation, and we are not going to imply one with a badge.
  • No published penetration test. If that changes, this page will say so with a date.
  • Isolation is enforced in the application, by scoping every query to your workspace — not by database row-level security policies.
  • Multi-factor authentication is not available yet. Sign-in is by password or Google sign-in.
  • The Keyword Planner scope is not read-only, because Google does not offer a read-only Ads scope. It is optional.

Reporting a vulnerability

If you believe you have found a security issue, contact us with enough detail to reproduce it and please give us a reasonable window to fix it before disclosing it publicly. We will confirm receipt by email.

Read-only from the first click.

Connect a property, see your own data, and disconnect whenever you like. Free to start.

Get started free No credit card required.