Security and privacy
How we look after your site and data
Connecting a tool to your website and your Google account is a real decision. This page explains what Blog AI can access, where it’s kept, how it’s protected, and what you can do about it, in plain words.
The legal detail (what we collect, why, for how long, and every provider that processes it) is in our privacy policy.
The short version
Read-only Google access
Credentials in a vault
Your data in the EU
One customer, one set of data
Nothing publishes without you
Export or delete, any time
What Blog AI can access
| Connection | What Blog AI can do with it |
|---|---|
| Google sign-in | Your name, email address and profile picture, to create your account. Signing in doesn’t give access to Search Console or Analytics. |
| Google Search Console (read-only) | Read clicks, impressions, positions and searches for the property you pick. More detail. |
| Google Analytics 4 (read-only, optional) | Read organic sessions, engagement and key events per page. More detail. |
| WordPress (application password) | Whatever your WordPress user may do; Blog AI uses it to import posts and pages and to create and update posts you publish. You can revoke the password in WordPress at any time. More detail. |
| Strapi (API token) | Whatever the token allows. We recommend a custom token limited to articles, categories, tags and uploads. More detail. |
The optional Blog AI Connector plugin for WordPress stores no personal data and never contacts Blog AI. It lets users who can edit a post read and write that post’s Yoast or Rank Math fields through the WordPress API, and hides those fields from everyone else. Its only outbound request tells IndexNow about a new or updated post, from your site, and you can turn it off.
How your data is protected
Storage
Your account, sites, posts and synced Google data are stored in a Postgres database in the EU, encrypted in transit and at rest. Third-party credentials are kept in a separate encrypted vault that only our servers can read; they’re never sent to your browser and never shown again once saved.
Access control
Row-level security is switched on for every table, so a signed-in customer can only ever read their own rows. Anything that changes data goes through our server, which checks that the site or post belongs to you before it acts. An automated test checks the access rules of every table, including new ones, and fails if any table is readable when it shouldn’t be.
The website and app
- https everywhere, with browsers told to insist on it (HSTS).
- A content security policy that limits which scripts can run, and protection against being framed by other sites.
- Protection against cross-site request forgery on every request that changes data.
- Rate limits on sign-in, AI actions, publishing, uploads, the contact form and the free blog audit.
- Uploaded images are checked by their actual contents, not their file name, and stored privately.
- Payment and email webhooks are verified by signature and rejected if the signature is missing.
Connections to your site
When Blog AI connects to your WordPress or Strapi site, it only uses public https addresses and re-checks every redirect, so a connection can’t be pointed at a private network. It never follows a redirect when writing, so a post can’t be silently sent somewhere else.
Payments
Payments are handled by Stripe. Your card details go straight to Stripe; Blog AI never sees or stores them.
Keeping it that way
We reviewed the whole service’s security before launch, re-run those checks whenever we add a new part of the app, check our dependencies for known vulnerabilities, and keep written procedures for incidents, key rotation and restoring backups.
AI providers and your content
To write and check a post, Blog AI sends the relevant material to AI providers: your topic, the searches it targets, your voice profile, extracts from your existing posts for linking, and the draft and its sources for checking. Images are generated by a separate provider from a short description.
We don’t sell your data, don’t use Google data for advertising, and never use it to train general-purpose AI models. Anthropic, which provides the models that research, write and check drafts, doesn’t train its models on data sent through its commercial API. Every provider, what it does and where it processes data is listed in section 5 of the privacy policy.
Your controls
| You want to… | How |
|---|---|
| Download your data | Settings → Export my data: everything we hold about you as JSON, with CSV for tables. |
| Delete your account | Settings → Delete account. Your data is removed straight away and your subscription cancelled; backup copies are overwritten within 30 days. Payment records are kept for 6 years because tax law requires it, no longer linked to you. |
| Withdraw Google access | Disconnect the Google account in Blog AI (this also revokes our access at Google), or remove Blog AI in your Google account’s third-party access settings. |
| Withdraw WordPress access | Revoke the application password in WordPress under Users → Profile. |
| Withdraw Strapi access | Delete or regenerate the API token in Strapi under Settings → API Tokens. |
| Stop emails | Turn off the weekly digest, posting reminders and product updates in Settings, or use the unsubscribe link in any such email. |
Report a vulnerability
If you think you’ve found a security problem in Blog AI, email hello@blogaihq.com with “Security” in the subject. Tell us what you found and how to reproduce it. Please don’t access other people’s data, degrade the service or publish the issue before we’ve had a chance to fix it. We’ll acknowledge your report and keep you updated. We don’t run a paid bug bounty.
For privacy requests (access, correction, objection), email privacy@blogaihq.com.
Security questions
Is it safe to connect Search Console to Blog AI?
Blog AI asks for read-only access. It can read performance data for the property you choose and nothing else: it can't change settings, add users, submit or remove URLs. You can withdraw access at any time, from Blog AI or from your Google account.
Can Blog AI staff read my content or Google data?
We don't look at your Google data unless you ask us to (for support), it's needed for security, or the law requires it. Your posts and drafts are stored so the product can work, and we look at them only for the same reasons.
Is my content used to train AI models?
We never use your Google data to train general-purpose AI models, and Anthropic, which provides the models that write and check drafts, doesn't train its models on data sent through its commercial API. The providers involved are listed in the privacy policy.
Do you have SOC 2 or ISO 27001?
No, not today. We're a small company and would rather tell you exactly what we do than point to a badge. If your organisation needs a security questionnaire answered, contact us.
What happens if something goes wrong?
We have written procedures for incidents, rotating keys and restoring from backups. If a breach affects your personal data, we'll tell you and the Data Protection Commission as the GDPR requires.