---
title: "Security at Serql"
description: "How Serql protects data: Clerk authentication, read-only Search Console access, encryption in transit and at rest, infrastructure providers, deletion, and responsible disclosure."
canonical: https://www.serql.io/security
markdown: https://www.serql.io/security.md
last-updated: 2026-09-14
section: legal
site: "Serql"
llms: https://www.serql.io/llms.txt
---

# Security at Serql

Canonical page: https://www.serql.io/security.

## Authentication

All authentication is handled by Clerk: Google OAuth, passkeys, and multi-factor authentication. Clerk handles authentication and passwords; Serql does not receive them. Agents use OAuth 2.0 access tokens issued by the same authorization server (https://www.serql.io/auth.md).

## Read-only Search Console access

Connecting Google grants read-only scope. Serql cannot change Search Console configuration. Google OAuth tokens and BYOK integration credentials are encrypted with AES-256-GCM (key: `TOKEN_ENCRYPTION_KEY`) before they are written to the database. Search Console performance data is fetched from Google on demand, cached for up to 6 hours, and never stored in the app's database.

## Infrastructure

Hosted on Vercel; data in managed Neon Postgres; Upstash Redis for temporary data: cached Search Console responses (up to 6 hours), cached SEO-integration results (6 to 24 hours), retry-replay records for write requests (24 hours), and rate-limit counters. Data is encrypted in transit (TLS); Neon encrypts the database at rest. Providers hold SOC 2 / ISO 27001 attestations.

## Payments

Stripe processes subscriptions; Serql stores only billing metadata, never full card details.

## Share links

Share links use cryptographically secure, unguessable tokens, are rate limited, and can be revoked instantly from the dashboard.

## Data deletion

Account deletion cascades through properties, classifications, annotations, reports, and share links.

## Responsible disclosure

Report suspected vulnerabilities privately to support@serql.io before public disclosure. We acknowledge reports promptly and credit researchers who wish to be named. See also `SECURITY.md` in https://github.com/snowopsdev/serql.