Security and trust
Veesie shows how AI assistants like ChatGPT, Gemini and Perplexity talk about your brand. To do that you trust Veesie with your brand data, and sometimes your Google Analytics. This page explains exactly how Veesie protects that data: sensitive fields encrypted, the database in Frankfurt, and every customer kept apart from the others.
Sensitive fields encrypted
Sensitive fields, like your Google tokens, are encrypted with AES-256-GCM. All connections run over HTTPS with HSTS.
Database in Frankfurt
Your account, brands and results are stored in a PostgreSQL database in Frankfurt. To measure, your questions also pass through services in the US; which ones is listed further down this page.
Read-only Analytics connection
The Google Analytics connection is read-only. Veesie can never change or delete your statistics.
Strict isolation
Each customer sees only their own data. Row Level Security is switched on for all tables, and the application checks ownership on every action.
1. Your data and AI monitoring
To measure how AI sees your brand, Veesie sends your prompts (questions about your brand, your sector and your competitors) to AI providers like OpenAI, Anthropic, Google and Perplexity. Veesie stores their answers in a database in the EU.
- The prompts are about brands and topics, not people. They normally contain no personal data.
- The answers, scores and analyses are stored in the database in Frankfurt. During a measurement, Inngest in the US keeps the intermediate results of each step.
- Veesie does not train any models on your data and does not use it for advertising. The AI providers receive your questions through their paid API, and under their terms they do not use them to train models.
2. Encryption
In transit
All traffic to veesie.com runs over HTTPS. Veesie sends a Strict-Transport-Security header (HSTS) with a two-year duration, so browsers never connect unencrypted after the first visit.
At rest
Sensitive fields in Veesie's database, like your Google Analytics access and refresh tokens and any webhook URLs, are encrypted with AES-256-GCM (authenticated encryption). If the encrypted data is tampered with, decryption fails automatically. The key is stored separately from the database as a Cloudflare Worker secret.
3. The Google Analytics connection
You can connect your Google Analytics 4 to Veesie to see traffic data alongside your AI visibility. That connection is deliberately minimal:
- Read-only: for Analytics, Veesie requests only the
analytics.readonlyscope, plusopenidandemailto show which Google account you connected with. Veesie can read your Analytics, never change, delete or share it. - CSRF-protected: the OAuth flow uses an HMAC-signed state bound to your account and website that expires after ten minutes. No one can force the connection on your behalf.
- Encrypted: the tokens Google returns are stored encrypted (see Encryption).
- Disconnectable: you revoke access at any time, both in Veesie and directly in your Google account.
4. Access and authentication
- Sign-in runs via Supabase Auth. Passwords are stored hashed, never in readable form.
- Sign-up, login and password-reset pages are protected against bots with Cloudflare Turnstile. The contact form uses a hidden field (honeypot) and a limit per IP address.
- Internal admin environments run behind Cloudflare Zero Trust Access and are not publicly reachable. The direct workers.dev URL is disabled, so that protection can't be bypassed.
5. Infrastructure and isolation
- Hosting: the application runs on Cloudflare Workers, on Cloudflare's global edge network.
- Database: a PostgreSQL database at Supabase in Frankfurt (EU).
- Multi-tenant isolation: each organisation sees only its own data. Row Level Security is switched on for all tables and limits direct access through the database API to a customer's own data. The application itself works with an admin role that bypasses RLS; there, ownership checks in every server action keep the data apart.
- Cloudflare and Supabase are both certified against international standards (including SOC 2 and ISO 27001) for their infrastructure.
6. Application security
Veesie is continuously reviewed for security internally. The codebase went through several internal security reviews against the OWASP guidelines for APIs and for LLM applications. Concrete measures include:
- HTTP security headers: a Content-Security-Policy with a fixed list of allowed sources, HSTS, X-Frame-Options (DENY), X-Content-Type-Options and a restrictive Permissions-Policy.
- SSRF protection: outgoing webhooks may only go to public HTTPS addresses; internal IP ranges are blocked.
- Prompt-injection hardening: stored AI answers and user input are neutralised before they go back into an AI prompt.
- Protection against CSV formula injection in exports, timing-safe comparison of secrets, and parameterised database queries against SQL injection.
No service can guarantee absolute security, but work on reducing risks and improving the measures is continuous.
7. Payments
Payments run via Stripe Checkout. Your card details go directly to Stripe, a PCI-DSS-certified payment provider. Veesie never sees or stores your card details; Veesie only keeps a reference to your Stripe customer.
8. Subprocessors
To deliver the service, Veesie works with a limited number of carefully chosen subprocessors:
| Subprocessor | Function | Location |
|---|---|---|
| Supabase (Postgres + Auth) | Database, authentication | EU (Frankfurt) |
| Cloudflare (Workers) | Application hosting, edge processing, and measurement of load times and page views (Web Analytics) across the whole site, including the dashboard, without cookies | Global network: a request runs through the data centre closest to the visitor, which for European visitors is normally in Europe. Cloudflare, Inc. (US), based on SCCs |
| Resend | Transactional email (notifications, reports). For the welcome email, the emails around the end of the trial, the reminder after an unfinished checkout and the report of the free GEO check, we record whether the email was opened and which link you clicked; not for reports and alerts | EU region |
| Stripe | Payment processing (only on a paid plan) | Ireland (EU) |
| Sentry | Error monitoring (error tracking) | EU (Frankfurt, Germany) |
| OpenAI, Anthropic, Google, Perplexity | LLM calls (prompts are sent to the providers) | Outside the EU, mainly in the US, based on SCCs |
| DataForSEO | Measuring Google AI Overviews (your questions are sent to Google as a search query) | EU (Estonia), with sub-processors partly in the US, based on SCCs |
| Inngest | Running the measurements (queue, retries and the intermediate results of each step) | US (Inngest Inc, AWS servers in the US) |
| Google Analytics 4 | Website statistics for the public website. Without your consent it runs without cookies, and never inside the dashboard | US (Google LLC), based on SCCs |
| Microsoft Clarity | Usage analytics: heatmaps and recordings of mouse movement and clicks. On the public website without cookies until you consent, never inside the dashboard | US (Microsoft Corporation), based on SCCs |
The core data (account, brands, results) is stored in the EU. During a measurement, your questions, your brand name and website, the names of your competitors and the generated recommendations also pass through Inngest in the US, which runs the measurements. Transfers to the AI providers outside the EU happen on the basis of the Standard Contractual Clauses (SCCs). The full list and explanation are in the privacy policy.
9. GDPR and your rights
The data controller for Veesie is Manon BV (trading as ClickForest), based in Bonheiden, Belgium, company number BE 0549.803.522.
- You can export your data in JSON format via Settings, Privacy. Tokens and internal keys are deliberately left out.
- You delete your account yourself via Settings, Delete account. Veesie then immediately erases your organisation, your websites, questions, measurements and results, your Google connection and your chat conversations, and cancels a running subscription at Stripe. A few things deliberately remain: if you completed onboarding, a hash (SHA-256) of your email address, so a new trial does not simply restart, the text of support tickets without name or email address, and your customer record and invoices at Stripe. Logs at the sub-processors in the table above expire according to their own retention period.
- All your GDPR rights (access, rectification, erasure, restriction, portability, objection) are described in detail in our privacy policy.
10. Reporting a vulnerability
Think you found a security issue? Email it to hello@veesie.com. Frederiek Pascal, founder of Veesie, and his team look into every report and keep you informed. Please don't make a vulnerability public before it has been fixed (responsible disclosure).
Last updated: 27 October 2026. Back to veesie.com