Security Policy

Version 1.0, last updated 29 October 2026. UtilitySEO Ltd | Company No. 17055142.

This page explains how to report a security problem in UtilitySEO, what we will do when you report one, and how we protect the data in your account.

1. How to report a vulnerability

Email security@utilityseo.com. Please include:

The page, address or feature affected
What you found and what someone could do with it
Clear steps to reproduce it, with screenshots or a short video if they help
Your name or handle, if you would like to be credited

Please write in English. If the issue is serious, put "Urgent" in the subject line.

2. What happens next

We reply within 5 business days to confirm we have your report.
We check it, tell you whether we can reproduce it, and keep you updated while we fix it.
When it is fixed, we tell you. With your permission, we will thank you by name on this page.

We do not run a paid bug bounty at the moment.

3. What is in scope

utilityseo.com (this website)
app.utilityseo.com (the UtilitySEO app)
team.utilityseo.com (the partner area)
The UtilitySEO crawler (see our crawler page)

4. What is out of scope

Denial of service, load testing or anything that slows the service down for others
Social engineering, phishing or physical attacks on our team
Spam, or flooding our forms and email addresses
Problems in services we use but do not run (such as Stripe, Google or Cloudflare). Please report those to the provider
Reports from automated scanners with no working example of the problem
Missing best-practice settings (such as a header or email record) where you cannot show real harm

5. Testing rules

When you look for problems, please:

Only use accounts you own, or test accounts you have made yourself
Never view, change or delete another customer's data. If you reach it by accident, stop, do not keep a copy, and tell us
Do not run tests that could harm the service or its users
Give us a reasonable time to fix the problem before you tell anyone else about it

If you follow this policy in good faith, we will not take legal action against you or ask anyone else to, and we will treat your research as authorised. If you are not sure whether something is allowed, email us first and ask.

7. How we protect your data

HTTPS encryption for all data in transit
Passwords stored using bcrypt hashing
Database encryption at rest
Backups held in access-restricted storage
Login protection, including email codes for two-step sign-in and limits on repeated failed logins
Access controls limiting staff access to personal data
Regular security reviews

Our Privacy Policy explains what data we hold, who processes it and how long we keep it. If a personal data breach poses a risk to you, we will tell you as the Privacy Policy describes.

8. Contact

Security reports: security@utilityseo.com Anything else: support@utilityseo.com or our contact page

You can also find these details in our security.txt file.