Security
Protecting your data is a core part of how we build CocoSEO. Here is an overview of our security practices.
Encryption
All data in transit is encrypted with TLS 1.2+. Passwords are hashed using bcrypt with a high work factor. API tokens and OAuth credentials are stored securely and never exposed in client-side code.
Authentication
We use short-lived JWT access tokens (1 hour) with refresh token rotation. Role-based access control separates user and admin permissions. Google OAuth is supported as a secure, passwordless sign-in option.
Infrastructure
Our application runs on isolated containerized infrastructure. PostgreSQL databases are encrypted at rest. File assets are stored in AWS S3 with server-side encryption. All services are behind rate limiting and CORS protections.
Third-Party Services
Content generation uses OpenAI and Replicate APIs. Your input data is sent to these services only for processing and is subject to their respective data handling policies. We do not share your data with any other third parties for marketing purposes.
Report a Vulnerability
If you discover a security vulnerability, please report it responsibly to security@cocoseo.co. We take all reports seriously and will respond promptly.