SEO agency security built on least privilege and your control

We connect Google Search Console and your analytics account through read-only OAuth. That gives your strategist the data needed for audits and reports without the ability to change your properties, users, settings or tracking. You approve the connection on Google's own consent screen, and you see exactly which properties are shared.

We never ask for the password to your Google account. If a connection is removed on your side, the panel shows it and your strategist asks in writing before anything else happens.

Least-privilege CMS roles

CMS access is needed only if you want us to implement technical fixes and publish content. When you grant it, we ask for the smallest role that does the job, for example an editor role in WordPress or a staff account with limited permissions in Shopify, never an owner or admin account.

• A separate user for AgencySEO, so every change in your CMS is attributable to us.
• No shared passwords and no logins reused from your own team.
• Two-factor authentication on the agency user wherever your CMS supports it.
• Developer-level access only where a fix truly requires it, agreed in writing in the panel first.

If you prefer to keep your CMS closed, your strategist hands technical fixes over as written tickets for your developer instead. See how this fits into technical SEO services.

Revoke in one click

The access center in the panel lists every connection and credential you have shared with us. Revoking one takes a single click and takes effect immediately on our side. You can also remove our user directly in your CMS or Google account at any time, without asking us. Access you granted always stays yours, including after you cancel.

We do not need personal data about your customers. For SEO and reporting we read aggregated analytics: sessions, conversions, revenue by landing page, impressions and clicks. We ask you not to share CRM records, order details or user lists, and a limited CMS role keeps that data out of reach in most systems.

The free SEO audit crawls only public pages of the domain you enter.

Data retention and deletion

While you are a client, we keep audit data, crawl results, reports and the record of decisions in the panel so you can see the full history of the work.

After you cancel, you can request deletion of your account data by writing to support@agencyseo.com. We delete it within 30 days, except invoices, which we keep as long as the law requires. Stored credentials are removed from the access center when you revoke them, and you can revoke them before or after cancelling.

Sub-processors

We use a small number of service providers to run the panel. We describe them by category:

• a hosting provider for the panel and its databases,
• a payment operator for checkout and billing,
• an email delivery provider for account and notification emails,
• an AI model provider for internal text processing, which never receives access credentials.

The administrator of the agencyseo.com service is responsible for the data processed in the panel. More detail is in our privacy policy.

If you find a vulnerability in agencyseo.com or the client panel, write to support@agencyseo.com with the steps to reproduce it. Please do not access data that is not yours and do not disrupt the service while testing. We confirm receipt in writing, investigate, and tell you when the issue is fixed.

If you suspect that access you shared with us has been misused, revoke it in the access center first, then write to us. Answers to other common questions are in our SEO agency FAQ.