Security & data

Vireloop holds the keys to publish on your sites, so credentials are treated as crown jewels and every organization's data is isolated at the database level.

Credentials & secrets

• Every secret — WordPress application passwords, OAuth tokens, service-role keys, ingest/revalidate shared secrets — is stored in Supabase Vault, never in a readable column and never in the browser.
• Connector calls, Vault access, and the service-role key run server-side only (Server Actions, route handlers, and the background worker). Keys never reach the client bundle.
• Google Search Console and GA4 use a service account (no OAuth); its private key stays in server environment variables. See Analytics.
• Secrets are shown once at creation and can't be retrieved again — if one is lost, generate a new one.

Data isolation (RLS)

• Row-level security is on for every table. Members can only read and write rows for organizations they belong to.
• Each connected site keeps its own credentials, keywords, plan, articles, analytics, and backlinks — separate from every other site.
• Org roles are owner, admin, editor, and viewer. A platform super-admin area is gated separately.

Publishing safety

• Article HTML is sanitized (allowlisted tags and attributes) before any publish call — raw model HTML is never sent.
• Client-site ingest and revalidate endpoints verify a per-site shared secret.
• Every publish attempt is logged (status, external URL, and any error) for audit and rollback.
• Nothing publishes below the quality bar, and (unless auto-publish is on) drafts wait in Review.

Next: Integrations →