Security, privacy and compliance.

CiteRank is a monitoring platform: we send prompts to supported AI engines, capture the answers those engines return, and analyse how brands appear in them. The data we hold is primarily configuration (brands, competitors, prompts), captured engine responses, and workspace account records. We do not require customer end-user databases, payment card data or health records to deliver the service, and we ask customers not to upload them.

CiteRank runs on managed cloud infrastructure rather than self-operated hardware. The web application is served from an edge/worker runtime with provider-level DDoS protection, and application data is stored in a managed Postgres platform with managed authentication. Physical and environmental controls are inherited from those providers.

We use third-party subprocessors to deliver the service. The categories below reflect current production use. The current named subprocessor list, including entity names and processing locations, is provided on request and attached to the DPA — email security@citerank.in.

Customers under a signed DPA are notified of material subprocessor changes before they take effect.

Monitoring data is retained for as long as your workspace is active, because historical runs are what make trend analysis possible. Retention windows for specific data classes, including shorter windows for regulated customers, are agreed in the contract.

The personal data we process is limited to workspace account data — names, work email addresses, role assignments and usage events. Monitoring prompts are business questions about brands and categories, not personal data, and customers are asked not to include personal data in them. Product analytics run behind a consent gate. Full detail is in the Privacy Policy and the privacy documentation.

CiteRank acts as processor for customer workspace data and offers a standard Data Processing Addendum covering processing scope, subprocessor notification, security measures, international transfer mechanisms and assistance with data subject requests.

We welcome reports from security researchers. Send findings to security@citerank.in with reproduction steps and the affected URL. Please give us reasonable time to remediate before public disclosure, do not access or modify other customers' data, and do not run denial-of-service or high-volume automated testing against production.

We do not currently operate a paid bug bounty programme.

Suspected security incidents are triaged by the engineering team on receipt. Our process is detect and contain, assess scope and affected workspaces, remediate, then notify. Where a personal data breach affecting customer data is confirmed, we notify affected customers without undue delay and within the timelines set out in the DPA.

Monitoring works by sending prompts to third-party AI engines and capturing what they return. This is the part of the service most often reviewed in security assessments.

• What we send: the monitoring prompt text you configure — category and brand questions such as "best enterprise AI visibility platforms". We do not send your customer records, uploaded documents or workspace credentials to AI engines.
• What we receive and store: the engine's answer text, cited sources and run metadata, so results can be compared over time.
• Where it is processed: inside each provider's own infrastructure, under that provider's terms. We use business/API tiers where available rather than consumer endpoints.
• Training: we do not authorise our providers to use customer prompt content to train foundation models where the provider's API terms allow opt-out.
• What we cannot control: an external AI engine's own retention, logging and abuse-monitoring behaviour. If your assessment requires provider-level commitments, request our current provider terms summary.