Security

The short version

Your monitoring runs on its own server, in the UK, with its own database. There is no shared multi-tenant database for a bug or a breach to cut across. Sign-in is passwordless, so there are no passwords for us to store or lose. And the data we hold about you is small by design: your domain, your prompts, and what the AI engines said about you.

Where your data lives

Everything is hosted on Amazon Web Services in the London region. Each customer gets a dedicated instance of the app with its own database on its own server: single-tenant, not a slice of a shared one. All traffic to the app and this site is encrypted in transit over HTTPS.

How you sign in

By magic link: we email you a one-time sign-in link that expires. We never ask you to create a password, which means there is no password database to breach and no reused password of yours at risk.

What we send to AI engines

To score your visibility we ask the engines the questions your buyers ask: the prompts you track, which name your market and sometimes your brand. That is all they receive. We never send them your customer lists, your account details or anything from inside your business.

Subprocessors

The full list of third parties that touch data on our behalf, and what each one does:

• Amazon Web Services (London region). Hosting for the app and this site. Servers run in the UK.
• Resend. Transactional email: sign-in links, reports and lead notifications.
• Stripe. Card payments. Your card details go directly to Stripe and never touch our servers.
• OpenAI. ChatGPT answers for your tracked prompts.
• Anthropic. Claude answers for your tracked prompts.
• Google. Gemini answers via the Gemini API. On this marketing site only, Google Analytics 4 with ad consent off: a first-party _ga cookie for visit counts, no ad cookies, aggregate counts only.
• Perplexity. Perplexity answers for your tracked prompts.
• DataForSEO. Google AI Overviews, AI Mode and Bing results for your tracked prompts.

Compliance, honestly

UK GDPR applies to everything we do, and our privacy policy covers your rights in plain English. We will sign a data processing agreement on request. We do not hold SOC 2: we are a small UK company and honest about it. If your procurement process requires SOC 2 paperwork, we are not your vendor yet. If it requires straight answers from the person who built the product, email the founder.

Found something?

If you think you have found a security issue, email hello@aeoscore.co.uk and put SECURITY in the subject line. You will get a reply from the founder, not a ticket queue.