Authentication

How access is scoped

SEOMadman authenticates to Google with read-only scopes only - webmasters.readonly and analytics.readonly. It cannot write to your accounts.

Tenant isolation

Every workspace is isolated by row-level security. A caller can only ever read data for a workspace they belong to; cross-tenant reads require an explicit, audited path.

Keys

Model keys (BYOK) are encrypted in Vault and never exposed. See BYOK and credits.