Resolve identity and scope.
The server verifies the session, workspace membership, role, selected property, provider connection, and requested capability.
Security controls for SEO data, provider credentials, and publishing authority.
Index Ledger separates workspace authorization, provider custody, workflow state, durable evidence, and external actions so a browser label or generated output cannot grant itself access.
Server-enforced rolesEncrypted provider tokensSigned billing webhooks
Control model
Authority is checked where the action happens.
Protected requests derive workspace scope from the authenticated session. Provider credentials and external mutations remain behind server-side authorization.
Workspace isolation
Every protected request derives its active workspace and property from an opaque authenticated session and an active membership. Client-supplied workspace or property identifiers do not grant access.
- Owner, admin, editor, and viewer capabilities are enforced at the server boundary.
- Invitations are bounded, expiring, single-use, revocable, and hashed at rest.
- Audit evidence records material workspace, billing, and provider operations.
Credential custody
Google and Bing OAuth tokens are encrypted at rest. Service-account credentials, Stripe secrets, session keys, webhook secrets, repository tokens, and background-job secrets stay in server-side bindings or secret storage.
Session safety
Sessions are opaque, HTTP-only, same-site cookies with absolute and idle expiry, bounded active-session retention, revocation, and secure transport attributes in production.
Provider mutations
Stripe webhook signatures are checked against the untouched request body. Business Profile posts require explicit approval. Content delivery creates review pull requests only. Eligible-page publication performs a fresh live structured-data check before every supported notification.
Background work
Long-running work uses queue-backed, leased, checkpointed jobs. Each delivery is bounded, duplicate deliveries are rejected, and successor work is enqueued only after the current checkpoint is durably sealed.
Honest limitations
Provider acceptance is not described as crawling, indexing, ranking, traffic, revenue, or causal impact. Ordinary URLs are never sent through Google’s restricted Indexing API.
Trust boundaries in practice
Three checks protect the path from request to receipt.
The security model is designed around explicit authority, bounded execution, and evidence that can be reviewed after the action.
Bound the external operation.
Queue leases, checkpoints, quotas, host validation, and provider-specific policy checks constrain the work being performed.
Store the result without overstating it.
Receipts, timestamps, audit events, and provider responses remain distinct from later crawl, index, ranking, or business outcomes.
Review complete?
Start with one workspace-scoped property.
Create a Free workspace through Google OAuth, then connect only the providers and team members your operating model requires.