This page is written for the person doing procurement review. It states what we actually do, including where we fall short of what a larger vendor would offer, because a security page that only lists strengths tells you nothing you can rely on.
Last updated: 12 August 2026
This page is written for the person doing procurement review. It states what we actually do, including where we fall short of what a larger vendor would offer, because a security page that only lists strengths tells you nothing you can rely on.
SearchScore is operated by Product Specialists LTD, registered in England and Wales. For UK GDPR purposes we act as a processor for the account data you give us, and as a controller for our own business records.
Data protection contact: [email protected]
Application servers and databases are hosted on dedicated infrastructure with IONOS SE, in London, United Kingdom. Your account data does not leave the UK except where a sub-processor below necessarily receives it.
The public website and API sit behind Cloudflare, which terminates TLS. All traffic to
searchscore.io and api.searchscore.io is HTTPS only.
For a Tracker subscription:
We never receive or store card details. Payment is handled entirely by Stripe; we hold only their identifiers. We do not store passwords: sign-in is by emailed link.
These are the third parties that necessarily see some part of your data, and why:
We will give 30 days' notice before adding a sub-processor that handles account data.
Where we fall short, stated plainly. Database files are not separately encrypted at rest; they sit on a dedicated host with restricted access. We hold no card data, no passwords, and no special-category personal data, so the material at risk is your business configuration and your scan history. We are a small team and do not hold SOC 2 or ISO 27001. If either is a hard requirement for you, we would rather tell you now than during onboarding.
For Enterprise subscriptions we commit to 99.5% monthly availability of the dashboard and API, measured per calendar month and excluding scheduled maintenance announced at least 48 hours ahead.
If we miss it, you may claim a service credit against the following month: 10% for availability below 99.5%, 25% below 99%, and 50% below 95%.
What the commitment deliberately does not cover. Scan delivery timing is excluded. A scan asks six third-party AI engines, and when one of them is degraded or rate limiting, the delay is theirs and we cannot honestly promise around it. We report per-engine failures rather than hiding them in an average, so you can always see which engine did not answer and when.
If we become aware of a personal data breach affecting your account we will notify you without undue delay and in any event within 72 hours of becoming aware, with what we know, what we are doing, and what you may need to do.
You can export everything we hold about your scans at any time, without asking us: the cell-level export gives one row per question, engine and scan, in CSV or JSON. See the API guide.
For access, correction, deletion or portability requests, email [email protected]. We respond within 30 days.
A signable data processing agreement is available on request for Scale and Enterprise accounts.