Security and data
What Lastmod does with your data
And, just as important, what it can't do.
30-day free trial · no credit card · database and hosting in the EU
How your data moves
Lastmod reads, you act. Nothing flows back to your site.
Your website
Crawl, only the website you have access to
Google Search Console
Read-only
Google Analytics 4
Optional, read-only
Google PageSpeed Insights
Measures your public pages
Read-only
Lastmod
Database and hosting in the EU
Tasks and reports
You
Anthropic
AI analysis: explanations and suggested text, United States
External SEO data provider
Search results and keyword data, EU
How we protect it
- Hosted in the EU, with AI analysis in the US
- The database runs in Frankfurt and the application servers in the EU. For AI analysis we send page titles, meta descriptions, headings, search queries and measurement results to Anthropic in the United States, under EU Standard Contractual Clauses. A few other providers handle limited technical data outside the EU. Every provider is on the sub-processor list.
- Lastmod doesn't edit your site
- It has no write access to your site. It suggests, you decide and act, and Lastmod checks the page afterwards.
- Read-only access to Google
- Search Console access is read-only. Tokens are encrypted with a key per token (AES-256-GCM), never sent to your browser, and deleted when you disconnect or delete your account. You can also remove Lastmod's access in your Google account at any time.
- Only domains you can show access to
- Before any crawl or sync, you show that the domain is yours, with a DNS record or as owner in Google Search Console. A Google account with access to the whole domain in Search Console also counts. With proven ownership the crawler stays inside that domain; with access alone it stays on the website's own two addresses, the domain and its www version. It refuses private network addresses and checks every redirect again.
- Your organisation's data stays separate
- Every query is scoped to an organisation in the data layer, and a query without a scope is rejected. The rules are tested against a real database.
- Sign-in basics, done properly
- Passwords of at least 12 characters, mandatory email verification, session cookies that scripts in the browser can't read, password-reset links that expire after an hour and end all sessions, and rate limits on sign-in.
- Export, deletion and your GDPR rights
- The owner exports all organisation data from Settings as JSON, without secrets. The owner can also delete the organisation there; after a 7-day grace period, in which you can still cancel, it is permanently deleted. Access to and correction of personal data under the GDPR (AVG) go through the contact details in the privacy policy.
- Automatic clean-up
- Old crawl and performance data is deleted automatically, after 90 to 365 days depending on your plan.
- Deterministic detection
- Opportunity detection runs on fixed rules against your data. AI is used only to explain findings and draft suggested text, never to decide what counts as an issue.
What we don't have yet
- An independent certification or penetration test.
- Two-factor sign-in for customer accounts (our own staff accounts require it).
- A data processing agreement (DPA) ready to sign. If you need one, ask us before you connect a site.
Questions before you connect a site?
Start with the free trial: one site, no credit card, and you can export your data or delete your account yourself afterwards.
30-day free trial · no credit card · database and hosting in the EU