Security at SpyGlow.

Competitor Monitoring Boundaries

• Public data only: SpyGlow monitors publicly accessible competitor web pages. We do not access password-protected or private content.
• No access-control bypass: SpyGlow is not built to circumvent logins, private workspaces, internal tools, or technical access controls.
• Customer-selected targets: Customers configure the competitors and public pages they want to monitor, and must have the right to monitor those targets.

Read the full monitoring methodology on How SpyGlow Monitors.

Overview

We build SpyGlow with a security-first mindset. This page describes how we protect your data, authenticate users, monitor public competitor pages, and handle AI processing. If you have questions, contact Click to show email.

Data Protection

• Encryption in transit: All communication between your browser and our servers uses TLS 1.2+ (HTTPS), and HTTP Strict Transport Security (HSTS) tells browsers to connect over HTTPS only.
• Data storage: Application data is stored on servers we run, with restricted access. Encryption at rest is a planned enhancement.
• Secrets management: Application secrets (API keys, database credentials) are stored in environment variables on the server, never in client-side code or public repositories.
• Access control: Production server access is restricted to authorized personnel only.

Authentication & Sessions

• Authentication: You can sign in with Google, with a one-time code sent to your email, or with an email and password. Sessions use signed tokens that expire.
• Rate limiting: Failed password sign-ins are throttled per account and per IP address, requests for and checks of email sign-in codes are rate-limited, and API requests are rate-limited, to prevent brute-force attacks and abuse.
• Input validation: All user inputs are validated and sanitized on both the frontend and backend before processing.

AI & Data Processing

• Data isolation: Each account's competitive intelligence data (competitor lists, monitoring history, AI-generated insights) is scoped to that account and is not visible to other customers. On the Teams plan it is shared with the members of your team workspace. SpyGlow staff access is restricted to authorized administrators, who can view account data to provide support and investigate security issues. Signing in as a customer for support requires extra verification and is recorded in an audit log.
• AI processing: When you use features like AskGlow, Content Gap Analysis, or Battle Cards, your queries and relevant data are sent to third-party AI providers for processing. These providers do not use your data to train their models.
• No model training: We do not use your private data, competitor lists, or generated insights to train any public AI models.
• Caching: AI context data may be temporarily cached in memory to improve performance and is cleared when the session ends or the cache reaches capacity.

Competitor Data Handling

• Public data only: SpyGlow monitors publicly accessible competitor web pages. We do not access password-protected or private content.
• Per-account isolation: Scraped content, screenshots, and monitoring history are scoped to your account and are not visible to other customers. On the Teams plan they are shared with the members of your team workspace, and SpyGlow staff access is limited to authorized administrators as described above.
• Retention: Page snapshots and change history are retained while your account is active and deleted within 30 days of account deletion.

Infrastructure

• Hosting: SpyGlow runs on monitored servers. The application restarts automatically if a process stops, and each release is health-checked as it goes live and rolled back automatically if the checks fail.
• Logging: Application logs record errors and service events so we can find and fix problems. They include account identifiers such as user IDs, email addresses, and domains. Known sensitive fields, such as passwords, sign-in codes, tokens, and payment card details, are redacted from log data. Only authorized administrators can read the logs, and application log files are deleted after 14 days (30 days for error logs).

Subprocessors

We work with the following third-party services to deliver SpyGlow:

Your data is stored on servers we run ourselves, not with a separate database provider, so no database company appears in this list.

Vulnerability Disclosure

If you discover a security vulnerability, please report it to Click to show email. We will:

1. Acknowledge receipt within 48 hours
2. Investigate and provide an initial assessment within 5 business days
3. Keep you updated on remediation progress

We ask that you give us reasonable time to address the issue before any public disclosure.

What We're Working On

We are continuously improving security. Planned enhancements include:

• Two-factor authentication (2FA)
• Encryption at rest for all stored data
• A Content Security Policy (CSP) for the web app
• SOC 2 preparation

Contact

Security questions? Email Click to show email.