Security & data handling

For agencies who need to answer "what happens to my clients' data?" before connecting anything.

What Casient can access

Connection	Google scope	What is read	What is never possible
Search Console	`webmasters.readonly`	Clicks, impressions, CTR and average position by date, page and query; the list of submitted sitemaps. Only for the properties you select.	Changing settings, adding or removing users, submitting sitemaps, requesting indexing.
Google Analytics 4 (optional)	`analytics.readonly`	Aggregated Organic Search totals — sessions, key events and revenue — by date and by landing page, for the properties you map.	Editing the property, managing users, visitor-level data, audiences or advertising identifiers.
Your public pages	none	When you ask the assistant for title ideas, Casient fetches that one public page to read its current title, meta description and headings.	Crawling your site, logging in anywhere, fetching pages outside the property.

Prefer not to connect at all? The free action list tool works from a Search Console export, in memory, and stores nothing.

How it is protected

All traffic is encrypted in transit (HTTPS/TLS).
Google access and refresh tokens are encrypted at rest and never shown in the interface, logs or API responses.
Each workspace can only ever see its own properties, actions and reports.
Google user data is not sold, rented or used for advertising.
Public result cards and client reports are unlisted, marked noindex, can hide the client's identity and can be revoked at any time.

Subprocessors

Provider	Purpose	Data involved
SW Hosting (Spain)	Application hosting and database	All Service data
Google	Search Console and GA4 data source; optional sign-in	OAuth tokens, reporting data
Stripe	Payments	Billing details (cards never touch Casient)
Zoho Mail	Transactional and product email	Email address, email content
OpenAI	Optional AI suggestions and drafts	The page URL, its current title/description/headings and the related search queries for the action you ask about
GoDaddy	Domain services	None of your Service data

Retention and deletion

Page-level Search Console and GA4 data is replaced on every scan: Casient keeps only the current comparison windows, not an ever-growing copy.
Settings → Privacy lets you delete one property's imported data, or the whole account, yourself. Deletion cascades to its actions, reports, result cards and case studies.
After account deletion, data is deleted or anonymised within 30 days; encrypted backups roll over within 90 days.
You can revoke Casient's access at any time from your Google account permissions page.

Data processing agreement

Agencies connecting client properties can request our DPA, including the subprocessor list above and standard contractual clauses where relevant, at [email protected].