Security & data handling

Principles

Security at Seoryx starts with handling as little data as the work requires, and being honest about what we do and do not do. Five principles govern how we treat your data.

Data minimisation

We take only the signals a decision needs. We do not collect data speculatively, and we do not use your data to train a proprietary model. Seoryx orchestrates general-purpose models alongside the data you connect; models may be selected by task and availability.

Scoped access

Access is limited to the specific portfolio, pages and sources you agree, and to the people working on your engagement. It is not open-ended.

Anonymised sample option

Where a representative sample is enough to move a decision forward, you can provide anonymised or redacted data instead of a full connection.

Human-in-the-loop

A human operator always approves before a decision becomes a work order. A verification window measures change against a locked baseline; it is not causal proof and not a forecast, and outputs may be wrong and must be reviewed. How human approval sits inside the decision method is described in the technical methodology.

No public customer data

We publish no customer logos and no live customer screenshots. Product imagery uses representative demo data only.

The data lifecycle, step by step

Here is the actual path your data follows, in order, from the moment an engagement begins to the point a backup finally ages out.

Approval

You decide to proceed and confirm what Seoryx may work on. Nothing connects before this.

Scope

We agree the specific portfolio, pages and data sources that are in scope, and access is bounded to that agreement.

Connection / import

You connect a source or provide an export. We take only what the agreed scope needs, and you can choose an anonymised sample where that suffices.

Processing

Money-page signals are turned into one decision and an evidence-backed work order. A configurable multi-AI review can run where it is useful; it does not run on every task, and it never publishes or executes anything.

Reviewer access

People working on your engagement can see the relevant data to do that work. Access remains scoped to the engagement.

Human approval

A human operator approves before a decision becomes a work order. Seoryx does not change or publish any website on its own.

Retention

We keep connected and imported data only while it is needed for your engagement.

Precise retention periods are to be confirmed and will be documented in the applicable agreement.

Revocation

You can revoke a connection or withdraw access at any time.

Deletion

On request, we delete the engagement data we hold in our active systems.

Backup expiry

Copies present in routine backups are not retained indefinitely; they age out of the backup cycle after deletion from active systems.

Access & revocation

Access to your data is granted on a need-to-work basis and stays tied to the engagement it was agreed for. You remain in control of the connections you make. If you revoke a connection or ask us to withdraw access, that access ends; where a connection is issued by you (for example, a token or grant on your side), you can also revoke it directly at the source.

Deletion on request

You can ask us to delete the data we hold for your engagement, and we will remove it from our active systems. Data held in routine backups is not kept indefinitely and expires as those backups cycle. To make a request, or to ask what we hold, email hello@seoryx.app. Deletion and access rights are described further in our privacy notice.

Bot protection

Our pilot form is protected by Cloudflare Turnstile, an anti-bot challenge that helps prevent automated abuse of the form. Turnstile runs on Cloudflare’s own domain (challenges.cloudflare.com) and may set a cookie on that domain to run the challenge. It appears only in connection with the pilot form; the other third party present during ordinary browsing is Google, which serves Google Analytics 4 (see below).

Email & form handling

When you submit the pilot form, strictly-necessary WordPress and Contact Form 7 cookies (session, form-integrity and nonce) may be set to process that submission securely. Transactional email is delivered through Mailgun (operated by Sinch), using the EU region and the sending domain email.seoryx.app. Data in transit to our form and email providers is protected using HTTPS/TLS. We use Google Analytics 4, loaded through the Google Site Kit plugin, to understand aggregate site usage. Google Consent Mode is enabled and analytics storage is denied by default for every visitor, worldwide: GA4 sets no analytics cookies unless you accept in our banner, and rejecting keeps it denied. We use no advertising, marketing or cross-site tracking technologies, and no first-party cookies are set by ordinary browsing unless you accept analytics. Opening the pilot form may load Cloudflare Turnstile and necessary security storage. See ourcookies notice for the full audit.

Infrastructure

seoryx.app is served over HTTPS by nginx. The website and server are hosted with our hosting provider, YNVAR, on EU-based infrastructure. Cloudflare is used for two things only: authoritative DNS for seoryx.app and the Turnstile anti-bot challenge on the pilot form. Cloudflare is not acting as a CDN or reverse proxy for the site — traffic is served directly by nginx.

Subprocessors

We use a small number of subprocessors to run the website and deliver email. This list reflects our current processing.

These subprocessors are also covered in our data processing terms.

Current limitations

We would rather state our position plainly than overclaim. We do not currently hold formal certifications such as SOC 2 or ISO 27001. We do not claim encryption at rest, and we do not describe our security as “enterprise-grade”. The controls we can honestly state today are the ones described on this page: HTTPS/TLS protecting data in transit, scoped access limited to your engagement, Cloudflare Turnstile bot protection on the pilot form, and deletion of engagement data on request. If your requirements go beyond this, tell us and we will be straight about what we can and cannot meet.

Responsible disclosure

If you believe you have found a security vulnerability affecting seoryx.app or our handling of data, please tell us before disclosing it publicly. Email security@seoryx.app with enough detail to reproduce the issue; our machine-readable contact is published at /.well-known/security.txt. We will acknowledge your report and work with you in good faith to understand and address it. We do not currently operate a paid vulnerability-reward programme.