Each local area page used to take us half a day to create and optimize.
With SEOmatic, we can create hundreds of pages in the same time, which helps our clients make the best use of their budget.
It's transformed how we deliver scalable SEO solutions.
Will Hawkins
Marketing Director, Digi-Business UK
Agents read your Search Console data, do the work, and prove what actually moved. You decide what ships.
14-Day Free Trial. $1 today, not refunded, credited to your first payment.
Trust Center
SEOmatic's agents suggest changes to your website and, with your permission, apply them. That deserves more than promises. This page states only what the code enforces, labels what is policy, and says plainly what we have not earned yet.
Last reviewed September 24, 2026.
The exact permission each connection asks for, and what it can never do.
| Integration | Permission requested | Can we modify it? |
|---|---|---|
| Google Search Console | webmasters.readonly | No, read only. Plus the Indexing API, used only for job posting and livestream pages, as Google requires. |
| Google Analytics 4 | analytics.readonly | No, read only |
| Google Sheets / Drive import | spreadsheets.readonly · drive.readonly | No, read only. The Drive file picker uses the narrower drive.file scope, limited to files you pick. |
| Google Business Profile | business.manage | Only if you use GBP features |
| Google Ads (optional) | adwords | Google offers no read-only Ads scope, so this scope is full access. We only read campaign and conversion data, and only if you connect Ads. |
| Your CMS (WordPress, Shopify, Webflow…) | The token you create | Yes, that is the product. You can revoke the token in your CMS at any time. We notice and stop. |
Every CMS and integration credential you connect is encrypted with AES-256-GCM before it reaches our database, at every write path.
App servers on Hetzner (US). Database on Amazon RDS (US). Uploaded files on Amazon S3 (US).
Deleting your account schedules real deletion: within 30 days (after a grace period in which you can cancel), your workspaces, connections and stored credentials are permanently deleted. Billing records are kept only as tax law requires.
Agent traffic to your site comes from our server's published IP address, so your firewall can allow it and your logs can recognize it.
The agent starts switched off. When you turn it on, you choose the mode; Assisted is recommended at setup, and you can change it anytime. Every safety rule below applies in every mode.
Level 1
DefaultBy default, every change waits for your click, and nothing touches your site until you approve it.
Level 2
RecommendedSmall, reversible fixes like titles, image descriptions and links run on their own once your plan is active. Bigger work still asks first.
Level 3
Available on any paid plan or trial, and suggested once 5 changes have gone live with zero rollbacks. Every change to an existing page keeps a copy of the original, and one click puts it back.
Your homepage, pricing, checkout, login, billing and legal pages are never edited automatically, in 7 languages. You can also protect any page, or a whole section with /landing/*.
Redirects, de-indexing, merges and deletions can never run unattended, in any mode. They also always require an admin.
Want image descriptions on auto but titles held back? Tick any capability and it always waits for your approval.
Unattended work stays under a daily credit cap you set. The off switch stops work in progress within one cycle.
Before any edit to an existing page, the agent saves the page as it was. Undo restores that exact version, from the task, from the activity feed, or with one workspace-wide button.
If you edited a page after the agent did, an automatic revert refuses to overwrite your work, and a manual undo warns you first.
A small automated change that measurably hurts its own page is rolled back automatically; bigger changes surface a suggested revert for your click. If a revert fails, a human on our team is alerted.
Every action lands in a permanent ledger: what changed, when, and the before and after. The receipt shows in your activity feed.
Moonshot (Kimi) is the main model, with DeepSeek as its outage backup, Anthropic Claude for specific jobs, and OpenAI and Replicate for images and embeddings. Optionally, a workspace can run its text generation on Anthropic or OpenAI using its own API key (the provider bills you directly; explicit recorded confirmation required). We use each provider's business API, never their consumer products.
Moonshot is China-hosted. Workspaces marked EU-sensitive are forced onto Anthropic in code - running on your own Anthropic API key, with an explicit recorded cost confirmation - so a routing mistake can never send their content to a non-compliant provider.
We never train models of our own on your data. Provider terms vary: Anthropic and OpenAI process API traffic under terms that exclude training on customer content; Moonshot's API terms carry no equivalent enterprise guarantee - which is exactly what the EU-sensitive toggle is for. Flag a workspace and its content runs only on Anthropic, on your own API key and agreement.
AI-written content must pass an independent quality review before it can go live; deterministic fixes carry a saved rollback instead. The agent refuses to invent facts, dates or links, and page content is fenced against prompt injection.
Cards only show figures computed from your own Search Console data, never a model's guess dressed up as a metric.
Every company that may handle customer data on our behalf, and why.
| Provider | Purpose | Region |
|---|---|---|
| Hetzner | Application hosting | US |
| Amazon Web Services | Database (RDS), file storage (S3) | US |
| Stripe | Payments | US / EU |
| Moonshot AI | Content writing and review (EU-sensitive workspaces' content is never processed here); also one of the answer engines queried by visibility scans | China |
| Anthropic | Content writing and review; one of the answer engines queried by visibility scans | US |
| OpenAI · Replicate | Image generation, text embeddings and some text tasks; OpenAI is also one of the answer engines queried by visibility scans | US |
| Perplexity · Google Gemini · xAI | AI answer engines queried by visibility scans (we send them the scan questions about your brand) | US |
| DeepSeek | Outage backup: a request Moonshot fails to start may be retried once on DeepSeek. Never used for EU-sensitive workspaces | China |
| Ahrefs · Semrush | SEO metrics for domains you analyze, only on your own API key | US / EU |
| Brandfetch · logo.dev | Brand assets (logos, colors) for domains you analyze | US / EU |
| ipinfo.io | IP country lookup for currency display | US |
| hCaptcha | Abuse prevention on public forms and free tools | US / EU |
| Google APIs | Sign-in, Search Console, Analytics, indexing, and the Google integrations you connect; Cloud Natural Language and PageSpeed Insights for page analysis | Per Google |
| DataForSEO | Search results and keyword data | US |
| IndexMeNow | Indexing submissions of your published URLs, only on your own API key | EU |
| IndexNow | Notifies Bing, Naver, Yandex and Seznam about your published URLs, only if you turn IndexNow on | Per engine |
| Bento | Product email | US |
| PostHog | Product analytics | US |
| Crisp · Featurebase | Support chat on our website; product feedback, changelog and surveys | EU / US |
| Calendly | Booking calls with us | US |
| Rewardful | Crediting affiliate referrals on our website | Per provider |
| LinkedIn · X | Optional sign-in | Per provider |
Found a security issue? Email contact@seomatic.ai with "Security" in the subject. Every report is read by a person, and we confirm receipt within 3 business days.
Machine-readable contact: /.well-known/security.txt on seomatic.ai and app.seomatic.ai.
Not yet, and we would rather tell you than decorate.
Not certified. If we pursue them, this page will show real progress, not early badges.
Monitoring is internal today. A public status page and incident history are on the roadmap.
Our standard GDPR Art. 28 DPA is published at seomatic.ai/dpa - email contact@seomatic.ai for a countersigned copy, normally within 2 business days.
