The current public product uses these controls:
Transport: The website, account flow and API use HTTPS in production. The JSON API also sends content security, frame, referrer and content-type headers.
Account access: Sign-in uses email links or Google OAuth. AIGROW does not ask you to create an AIGROW password.
Payments: Checkout is hosted by Stripe. AIGROW stores the customer, subscription and purchase state needed to provide the service, not full payment card details.
Connector secrets: Google Search Console credentials submitted through Blog Engine are encrypted before database storage. The feature refuses to store them when its encryption key is missing or invalid.
Certifications: AIGROW does not currently claim SOC 2 Type II or ISO 27001 certification and does not publish an independent penetration testing report.
Custom projects can involve different systems and providers. Their written scope should name the required access, data flow, hosting, monitoring and operating responsibilities before credentials are shared.
For more details, visit our Security page.