How SEOWrix protects your work

Last updated 25 September 2026

SEOWrix is an internal tool, so it is built to keep people out by default. These are the protections in place today.

Our own server

The app, its PostgreSQL database, the job worker and the AI detector all run on our own server. Articles and research are stored in that database, not in a shared SaaS workspace.

Sign-in

• IP allow-list. Every sign-in is checked against a list of approved networks. Attempts from other networks are refused and logged, and an admin has to approve a new address.
• Two-factor codes. Admins must enter a code from an authenticator app on every sign-in, and an admin can require it when creating an editor account. Each code is accepted only once.
• Throttling. Repeated failed attempts lock sign-in for 15 minutes.
• Sessions. Sessions live in an httpOnly cookie over TLS, last 12 hours (4 hours for admins), and can be ended everywhere from Settings.
• Google and Microsoft sign-in works only for existing editor accounts with a verified address, still passes the IP check, and is never available to admins.

Passwords and secrets

• Passwords are stored only as bcrypt hashes.
• Secrets we must read back — authenticator seeds and WordPress application passwords — are encrypted with AES-256-GCM, using a key kept separate from the session secret.
• API keys for AI and search providers live in server configuration, never in the browser.

Access inside the app

• Every API request checks the session and role on the server; admin-only actions refuse editors and are logged.
• Sign-ins, refused attempts and admin actions are written to an audit log.
• Daily spending limits and per-account credit limits stop runaway costs.

Backups

The database is dumped every night and the last 14 days are kept. The admin server page shows when the last backup ran.

Your text stays with us

AI detection runs on our own detector, so no third-party detector sees your articles. Writing and research use the providers listed in the privacy policy, which receive only what a task needs. Your content is not used to train models.

Reporting a problem

If you find a security issue, e-mail [email protected]. Please do not test against other people's accounts.