Susanna Dashboard holds the Search Console data of your sites and a key to read it. We protect them as well as we can, and we want to hear about anything that could put them at risk.
How we protect your data
- Read-only access. The Service asks Google only for permission to read Search Console. It can’t change anything in Search Console, and it can’t see anything else in your Google account.
- Encryption. All connections are encrypted (HTTPS). Google’s refresh tokens, which give lasting access, are stored encrypted, with keys kept apart from the database.
- Secure sign-in. Signing in happens at Google, so we never see or store passwords. The sign-in cookie can’t be read by scripts on a page, is sent only over encrypted connections, and the sign-in with Google is protected against forged requests.
- Your data stays yours. Every request is checked, so you can see only the sites you have connected. This is covered by automated tests.
- Servers in the EU. The Service runs in the European Union. Our server gets security updates automatically, accepts only the connections the Service needs, and can be managed only with personal keys.
- Backups. The database is copied continuously to a separate provider in the EU and kept for 30 days. A backup is restored and checked every day.
- Monitoring. We are alerted if the Service, the data updates or the backups stop working.
- As little data as possible. We don’t store your IP address, and we fetch and keep only what the reports need.
More details are in Annex 2 of our Data Processing Agreement.
What you can do
- Turn on 2-Step Verification in your Google account: whoever can sign in to it can sign in to Susanna Dashboard.
- Sign out on computers that other people use.
- Share reports only with the people who should see them, and switch share links off when they are no longer needed.
- Disconnect Google accounts and remove sites you no longer use.
Report a vulnerability
If you think you have found a security problem in Susanna Dashboard, please write to security@susannadashboard.com. Tell us what you found, how to reproduce it, and what harm it could cause. You may write in English or Finnish.
We confirm that we received your report within 3 business days, keep you informed while we fix the problem, and tell you when it is fixed. If you want, we thank you by name once it is fixed.
Rules for testing
- Test only with your own account and your own sites.
- Don’t access, change or delete the data of other people. If you come across it by accident, stop, and tell us.
- Don’t overload the Service or try to make it unavailable, and don’t use automated scanners that send large numbers of requests.
- Don’t test with spam, phishing or other social engineering, or against our offices, staff or providers.
- Give us reasonable time to fix the problem before you tell anyone else, normally 90 days.
If you follow these rules and act in good faith, we won’t take legal action against you because of your research, and we treat your report as help.
Not in scope
- Problems in services of other companies, such as Google. Please report them to the company concerned.
- Missing security headers or settings that don’t lead to a real risk.
- Reports from automated tools without a working example.
We don’t pay rewards for reports at the moment.
Our contact details for security are also in security.txt.