Security
Security, stated plainly.
What we store, how it's protected, who can reach it, and what we don't claim. Written to be checked, not to reassure — every statement here matches the running system.
What we store — and what we never touch
OptimizeCamp stores your account details (name, email, hashed password), your brand profile, the prompts you track, the AI answers we collect on your behalf, and the metrics computed from them. Connect a WordPress site and we also store the content we audit and the credentials needed to deliver drafts back to it.
Payment card data never touches our servers. Checkout and billing run entirely on Freemius, our merchant of record — we hold your plan and license state, never a card number.
How credentials are protected
- Site connection secrets use envelope encryption: each record is sealed with its own random AES-256-GCM data key, wrapped by a 32-byte master key that exists only in the server environment and can be rotated. Decrypted secrets exist only in the moment a sync or publish runs.
- API keys are stored as SHA-256 hashes. You see a key once at creation — after that, no one can read it back, including us.
- Passwords are hashed with scrypt, a memory-hard function built to resist brute force. We never store or see a plaintext password.
- Everything moves over TLS, and the database is encrypted at rest.
Who can reach your data
- Accounts are single-user — your workspace is yours alone.
- API keys are scoped. Keys default to read-only; triggering runs requires a key explicitly created with the runs permission.
- OAuth connectors for claude.ai and ChatGPT are read-only by design — an assistant can read your visibility data, never change it or spend your credits.
- Sign-in, password reset and the public API are rate-limited.
- Shared report links are read-only, tokenized views — no login behind them, no write path through them.
Your content and the AI providers
To collect answers, your tracked prompts are sent to the platforms we measure — OpenAI (ChatGPT), Google (Google AI) and Perplexity. That is the product working as described, and each provider appears in the subprocessor list below.
What AI says about your brand is competitive intelligence — yours. It is never used to train third-party AI models. And generated articles reach WordPress as drafts only, fact-checked and sourced; a person clicks publish, every time. Both commitments are in writing on every plan.
Subprocessors
The complete list of services your data touches. Keeping it short is a deliberate choice — every additional processor is additional surface.
Data lifecycle
Cancel and your workspace goes read-only — never deleted. Come back in a year and every answer, score and trend is waiting.
Close your account or request deletion and we delete or de-identify your personal data within a reasonable period, keeping only what legal, accounting or security obligations require — the same commitment as our privacy policy.
Reporting a vulnerability
Found something? Email support@optimizecamp.com with enough detail to reproduce it — the same address is published in our security.txt. We read every report and acknowledge legitimate ones, and we will not take action against good-faith research that respects user data and gives us reasonable time to fix.
What we don't claim
No SOC 2. No ISO 27001. We may pursue certification as the company grows; until then we would rather show you the posture we actually run than decorate this page with a badge. What you have read above is checkable against the product — and when it changes, this page changes in the same release. A certification, when it lands, will be in the changelog.