OrganiqSecurity and data protection
Facts you can verify about how Organiq handles your Google data. Everything here is also in the privacy policy; this page is the short version. Version 0.4.0 of the connector.
What access does it ask for?
- Sign-in: Google scopes
openid email profile(e-mail, name, picture). - Search Console: scope
webmasters.readonly, read-only, only for the properties you activate. - Google Analytics 4 (optional): scope
analytics.readonly. You can decline it; everything else works without it.
No write scope is requested. The Google consent screen shows exactly these scopes.
Is anything written to my Search Console?
No. Google access is read-only and the server has no write operation on Google or Bing: no tool submits sitemaps, requests URL removals or changes anything in Search Console, GA4 or Bing. The 39 read tools only read (readOnlyHint: true); the 5 setup tools write only Organiq settings (linked GA4, Bing site and key, brand terms) and need the mcp:write scope.
How are tokens and keys stored?
- The Google refresh token is stored encrypted with AES-256-GCM and decrypted only in memory to call Google's APIs.
- Connector OAuth tokens and personal API keys are stored as SHA-256 hashes; the key itself is shown once, at creation.
- Access tokens last 1 hour; refresh tokens last 30 days and rotate on every use.
- Tokens never appear in URLs or logs. All traffic uses TLS.
How do AI clients authenticate?
OAuth 2.1 with PKCE (S256). The client identifies itself with a Client ID Metadata Document or dynamic registration, then opens the Organiq authorization screen, where you sign in with Google and see which application is asking. Only accounts with at least one connected property can approve. Clients without OAuth use a personal API key in the Authorization header. Details in the documentation.
How do I revoke access or delete my data?
- Google access: remove Organiq at myaccount.google.com/permissions; the sync stops immediately.
- An AI client: remove the connector in the client; its tokens stop working when revoked and expire by themselves within 30 days.
- API keys: revoke them in the dashboard.
- Everything: delete the account. Account, connections and tokens, keys, sessions, properties and history are removed at once; provider backups expire within 30 days.
Where does the data live, and who processes it?
- Google LLC: sign-in and the Search Console and GA4 APIs.
- Netlify, Inc.: hosting of the dashboard, the connector and the serverless functions (USA).
- Neon, Inc.: the Postgres database that holds the history (USA).
- Stripe, Inc.: payments and the billing portal; card numbers never reach Organiq.
- Microsoft: only if you connect Bing Webmaster Tools.
- The provider of your AI assistant (Anthropic, OpenAI, Cursor, Google): receives only the responses of the tools you call, never the full dataset.
Technical logs (IP, user agent, tool name, duration, account) are kept for up to 90 days for security and rate limits.
How do I report a vulnerability?
Write to youssefpmat@gmail.com with the steps to reproduce. Please do not test against other people's accounts or data.
Frequently asked questions
Does my conversation with the AI reach the server?
No. The connector receives only the tool arguments: property, dates, filters and limits. The conversation text never reaches the server.
Is my data sold or used to train AI models?
No. Organiq does not sell data, does not use it for advertising and does not train AI models on your properties' data.
Can people at Organiq read my data?
Database access is restricted to the operator and data is not read by humans except with your consent, for security or as required by law (Google API Services User Data Policy, Limited Use).
What happens to backups after I delete the account?
The account is removed from the main database immediately; provider backups expire within 30 days.