Security
How Sikwati protects accounts, connected services, website scans, and billing records.
Passwords are stored as secure hashes rather than readable text. Session cookies are HTTP-only, and password-reset links are time-limited and single-use.
Customer access is scoped by account and workspace membership. Workspace owners control invitations and can revoke a member's access.
Restricted administrative tools are available only to authorized operators for service monitoring, security, and support.
Google Analytics and Search Console connection tokens are encrypted before storage. You can disconnect either integration from Site Settings.
API tokens are stored as one-way hashes and are shown in full only when created. Shared-report links use protected tokens and can be revoked.
Sikwati scans only public web pages. Requests to private, local, or otherwise unsafe network addresses are blocked.
The crawler respects robots.txt and limits page discovery to 200 URLs per site.
Queue controls reduce duplicate processing, recover work that becomes stuck, and retain a clear status for completed or failed runs.
Repeated tracking failures pause the affected provider rather than continuing indefinitely. A failed check is treated as inconclusive, not as evidence that a business was absent.
Plan limits and monthly check allowances are enforced on the server. Removing old results does not restore checks that have already been used.
PayPal processes subscription payments. Sikwati stores payment and subscription references, but not your card or bank details.
If you have a security question or want to disclose a vulnerability, contact hello@sikwati.app. We welcome responsible disclosure made in good faith.