Security at Beacon

Our commitment

We take security very seriously. Beacon is built for small businesses, and we know your website, keywords, and customer relationships are your livelihood. We will never sell your data to third parties — not your account details, not your project data, not your usage patterns. Your data is used for one purpose only: running the service you signed up for.

Encryption everywhere

• In transit. All traffic between your browser and Beacon is encrypted with HTTPS (TLS). Unencrypted connections are not accepted.
• At rest. Site connection credentials (such as WordPress app passwords) are encrypted with AES-256-GCM before they ever touch our database.

Account protection

Sign-in is handled by Clerk, a dedicated authentication provider trusted by thousands of companies. Beacon never sees or stores your password. Sessions are short-lived, cryptographically signed, and automatically rotated. Every request to your account data is verified against your session before anything is returned, and you can only ever access projects that belong to your own account.

Payment security

Payments are processed entirely by Stripe, a PCI DSS Level 1 certified payment processor — the highest level of certification in the payments industry. Your card number never passes through or is stored on Beacon's servers. We keep only your subscription status and plan.

Defense against abuse and breaches

• Rate limiting. Automated throttling on every API endpoint blunts brute-force and scripted attacks.
• Hardened headers. Industry-standard security headers protect against clickjacking, content sniffing, and cross-site attacks.
• Strict cross-origin policy. Only Beacon's own domains may make authenticated requests to our API.
• Input validation. Requests are validated against strict schemas before they are processed, and all database access is parameterized to prevent injection attacks.
• Least-privilege access. Access to production systems is restricted, and administrative functions require separately verified admin accounts.

Your data, your control

You can delete your account and all associated data at any time from the in-app support chat. Deletion removes your projects, keywords, audit history, site connections, and support conversations. We keep your data only while your account is active — we do not warehouse it for other purposes.

Third parties we work with

A small number of vetted providers help us run Beacon — Clerk (sign-in), Stripe (payments), search-data providers (rankings and backlinks), and OpenAI (AI features). Each receives only the minimum data needed to do its job, and none of them are permitted to sell your data. Full details are in our Privacy Policy.

Reporting a security concern

Found a potential vulnerability? Email jgreen@greenspeed2lead.com with the subject “Beacon security report.” No account or sign-in is required. Include the affected page and steps to reproduce, but do not send passwords, API keys, or customer data. We appreciate responsible disclosure.