How AIGROW protects your data
Encrypted connections and credentials, sign-in without passwords, payments on Stripe and a Data Processing Addendum for every business customer. This page lists the controls running in production and the audited providers we run them with.
Security review or vendor questionnaire? Write to security@aigrow.gg.
- Connections
- HTTPS, HSTS
- Search Console keys
- AES-256-GCM
- Sign-in
- passwordless
- Card payments
- Stripe, PCI DSS L1
- Database backups
- nightly, encrypted off-site
- Data Processing Addendum
- included
Running in production today
Each control below runs in the current product. Our Data Processing Addendum sets out the security measures we commit to in writing.
Encrypted in transit
Every page, the console and the API are served over HTTPS only, through Cloudflare. HSTS tells browsers never to connect to AIGROW without encryption.
Sign-in without passwords
Email links that expire after 15 minutes, or Google sign-in protected by PKCE and state checks. AIGROW never asks for a password and stores none, so there is nothing to phish, guess, reuse or steal.
Encrypted credentials
Search Console keys are encrypted with AES-256-GCM before they reach the database, and the feature refuses to run without its encryption key.
Payments on Stripe
Cards are entered on Stripe’s hosted checkout, certified PCI DSS Level 1. AIGROW never receives a full card number.
Server protections
Servers in Germany with automatic security updates, automatic blocking of repeated failed logins, root login disabled and databases closed to the internet.
Nightly backups
The production database is backed up every night and kept for 14 days. An AES-256 encrypted copy goes to a separate storage provider and is kept for 30 days.
Browser protections
A Content Security Policy, frame blocking, a strict referrer policy and protection against MIME sniffing go out with every response.
Minimal data
AI API prompts and responses are not stored, only usage records. Report links are stored as hashes, expire and can be revoked. Sign-in, scan, contact, careers and checker forms are protected by hCaptcha and rate limits.
Least-privilege access
Before a custom project touches your systems, its written scope names each system, permission and data flow. Only people who need it to provide, support or secure the service can reach customer data.
DMARC on our domain
aigrow.gg has published a DMARC policy of quarantine since 28 October 2026, after 30 days of reports in which every legitimate sender passed aligned DKIM. Receivers are asked to treat mail that claims to come from aigrow.gg and fails these checks as spam.
Built on independently audited providers
Each provider below holds its own SOC 2 Type II or ISO 27001 audit. Each certification belongs to the provider named, and each one publishes it on its own trust page.
Privacy commitments in writing
Our Data Processing Addendum and Privacy Policy make each of these a contractual commitment.
We did this for aigrow.gg first
We sell an accessibility audit, an AI Act transparency kit and a DMARC setup, and we ran each one on aigrow.gg. The results are public.
What security teams ask
Storage, locations, AI training, questionnaires, contracts and incidents.