Security
Keats never touches your site
It reads your public pages and AI answers, and Search Console only if you connect it, read-only. Your data stays in your workspace and is never used to train AI models. Here is exactly what we keep, how it's protected and who else handles it.
What we keep, and why
- Your account
- Your email address, and your name and picture if you sign in with Google. A session record for each device you sign in on.
- Your workspace
- The brands, products, questions, competitors and action cards you track, and who in the workspace can see them.
- AI answers
- Each answer the assistants gave to your questions, with the brands named and the pages cited. The raw responses are kept in Cloudflare storage so they can be read again.
- Search Console
- When you connect it: the property you chose and a sealed token for reading it.
- Billing
- Your plan, its status and Stripe's ids for you. Card details stay with Stripe; Keats never sees them.
- A record of changes
- For every change made in a workspace, by a person in the app or with an API key: who, which operation, on what, how it ended, and when. Owners and admins read it in Settings → Audit log.
How your data is protected
Keats never changes your site
Keats reads your public pages. It has no access to your site or your CMS, and it doesn't publish, send or edit anything there. Your agent drafts; a person publishes.
Keys are scoped to one workspace
An API key works in the workspace it was made in and nowhere else; another workspace's data answers as if it didn't exist. A key is read-only or read-and-write, shown once, stored only as a SHA-256 fingerprint, and revoked in one click. Only owners and admins make or revoke keys. Each key may make 120 requests and 30 writes a minute.
Search Console is read-only
Keats asks Google for read-only Search Console access and nothing else, and refuses a grant that lacks it. The token is sealed with AES-256-GCM under a key kept only in our server's environment. Disconnecting forgets the token and asks Google to revoke it. You can instead add Keats's service account as a user in Search Console and remove it there.
Roles inside a workspace
A workspace has owners, admins and members. Owners and admins manage keys, billing and invitations, and read the audit log of every change. Keats's own admin pages are limited to named PressRoom staff.
Error reports carry no personal data
When something breaks we get an error report from Sentry with sign-in details, cookies, request bodies and keys removed before it leaves our servers.
Your data isn't for training
We don't sell personal data, show ads, or use your workspace's data to train AI models.
Who else handles it
These companies process data for us, each only for the job listed. Data is stored and processed in the United States.
- Vercel hosts the web app.
- Cloudflare runs the background jobs and stores raw answers fetched from AI assistants.
- Neon hosts the database.
- SendGrid (Twilio) delivers sign-in, invitation and early-access emails, from hello@getkeats.com.
- Google provides Google sign-in and, when you connect it, read-only Search Console data.
- DataForSEO supplies search data and fetches answers from ChatGPT, Gemini and Google’s AI results.
- Perplexity answers prompts through its API.
- Anthropic’s Claude models read a brand’s site and draft its offerings, competitors, prompts and action cards.
- Stripe takes payments and holds card details; Keats keeps only the plan, its status and Stripe’s customer and subscription ids.
- Sentry receives error reports, with sign-in details, cookies, request bodies and keys removed.
Your data, your call
Disconnect Search Console, revoke a key or remove a teammate whenever you like. An owner or admin can download everything a workspace holds (brands, questions, answers, sources and actions, as JSON and spreadsheets) from Settings → Workspace, and an owner can delete the workspace there; you can delete your own account from Settings → Account. Deleting is immediate and can’t be undone. Anything else, write to justin@pressroom.ai; we act on it within 30 days.
Whether everything is working right now: status.
Found a security problem? Email justin@pressroom.ai and we’ll look into it. The details of what we collect are in the privacy policy.
Find out what AI assistants say about you
Request early access. Keats reads public pages and AI answers, and never touches your site.