Security and privacy

Tenant isolation

Every table carrying customer data is protected by row-level security in Postgres. Access is evaluated by the database on every query, against the identity of the user making it.

The check is membership-based: you can read a project's rows only if you hold a role on the workspace that owns it. Child tables — prompts, entities, products, queries, answers, mentions, citations, placements, metrics — resolve through the project rather than repeating the rule, so there is one place where isolation is defined and one place to audit. Membership is tested once per query rather than once per row.

The important property is where this lives. Isolation is enforced by the database, not by application code remembering to add a filter. A missing where clause in a query returns nothing rather than someone else's data.

Two things back that up rather than asserting it: the anonymous role has no access to any GEO table, and the migration suite carries cross-tenant isolation tests that attack the policies as a real user of another workspace.

Read and write separation

Pipeline tables are read-only from the application. Answers, mentions, citations, sources, domains and daily metrics are written exclusively by backend functions using a privileged service role that never reaches the browser.

Users write configuration — projects, prompts, entities — and nothing else. Measurement data cannot be edited through the product by anyone, which is what makes it evidence.

Authentication

• Email and password, with confirmation on sign-up
• Google sign-in
• Password reset by verified email link
• Two-factor authentication (TOTP), enrolled per user and challenged at sign-in

Sessions are managed by the auth layer with rotating refresh tokens; signing out invalidates the session. See Account security.

Roles and permissions

Workspace access is role-based. Roles carry an explicit permission set — managing members, changing roles, handling billing, editing workspace settings — checked on every privileged action, server-side.

Membership is hierarchical: a member cannot alter someone at or above their own level, which prevents privilege escalation inside a workspace. Full breakdown in Teams and roles.

Administrative access

Platform administration is a separate surface behind its own authorization check, used for support and account operations. Administrative actions are gated by elevated authentication rather than by a role flag alone.

What data Geonimo stores

About your brand: the website, market and language you configured; your prompts, tracked entities and products.

Collected from engines: answers to your prompts, their citations, placements and the metrics derived from them. These are public AI outputs to public questions — nothing of yours is sent beyond the prompts you wrote.

From the tracker, if installed: pageviews, sessions, engagement signals and referral classification for visitors to your site. First-party, designed to work without third-party cookies. You remain the data controller; declare it in your privacy policy and consent flow like any analytics tool.

About your team: account details, roles and workspace membership.

Prompts and third parties

Prompts are asked of the AI surfaces through a collection provider — that is the measurement. They pass through that vendor and the engine itself.

Write them as buyer questions, and do not put confidential information in them: an unreleased product name in a prompt is an unreleased product name in two third parties' logs. This is worth saying plainly because prompt sets are often drafted from internal roadmaps.

Retention

Raw answer text is retained for ninety days, then cleared while mentions, citations and metrics are preserved. Historical metrics keep their full history.

Deleting a project removes its configuration and the derived data hanging off it. Workspace deletion removes the workspace and its projects.

Reporting a vulnerability

Email security concerns to the address on the contact page with enough detail to reproduce. Please do not disclose publicly before we have had a chance to respond.