What we access, and why.
Onboarding asks for access to a few of your accounts. This page lists every one of them, what it is used for, what it cannot do, and how to take it back. If a permission is not on this page, we do not ask for it.
1. Google account
The "Connect Google" step asks for two permissions, both read-only. Google shows them on the consent screen before you click Allow.
| Permission | What we do with it | What it cannot do |
|---|---|---|
| Google Analytics read | Pull sessions, conversions and landing-page traffic into your weekly report and health score. | Change settings, create or delete anything. |
| Search Console read | Read queries, clicks, impressions, index coverage and crawl errors for the property you picked. | Submit sitemaps, request indexing, add or remove users, verify or delete properties. |
2. Optional Google permissions
Anything that can change something in your Google account is asked for separately, at the step where you turn that feature on. Each one produces its own Google consent prompt listing only that permission. Decline any of them and the feature falls back to us emailing you the steps.
| Permission | Where it is asked | What we do with it |
|---|---|---|
| Search Console write | Step 4, Search Console | Submit your sitemap and ask Google to recrawl a page after we publish or fix it. Includes the Indexing API for the same purpose. We never remove properties or users. |
| Google Analytics edit | Step 3, GA4 property | Create Key Events (form submit, phone call, purchase) when your property has none, so reports can show leads. We never delete events, properties or data. |
| Google Ads manage | Step 11, Google Ads (optional) | Only for the Ads management add-on. Google offers one permission for Ads that covers reading and editing; there is no read-only version. Every change we make is logged and reversible from your dashboard. |
| Business Profile manage | Step 10, only if you allow GBP posts or review replies | Publish "What's new" posts and review replies under your business name. Reviews and profile data otherwise come from the public Places API, which needs no permission from you. |
We never ask for Gmail, Drive, Calendar, Contacts, YouTube or account sign-in scopes. You can see and remove every permission we hold at myaccount.google.com/permissions.
3. DNS and Cloudflare
DNS is used for a short list of things: the TXT record that verifies Search Console, SPF/DKIM/DMARC records so your email lands, the www to non-www redirect, and, when the site is behind Cloudflare, caching and security rules. You choose how much of that we can do ourselves.
Option A: your own Cloudflare account, scoped API token recommended
You stay the account owner. You create an API token limited to one zone (your domain) with these nine permissions and paste it into the wizard. We verify it against your zone before saving. Revoke it any time from Cloudflare's API Tokens page.
| Permission | Level | What we do with it |
|---|---|---|
| Zone | Read | Find your zone and confirm it is active |
| Zone Settings | Edit | Always Use HTTPS, minimum TLS, Brotli, SSL mode |
| Cache Rules | Edit | Static asset and HTML caching |
| Single Redirect | Edit | The www and non-www canonical redirect |
| Zone WAF | Edit | Let search and AI crawlers through; country blocking if you want it |
| Bot Management | Edit | Stop bot-fight mode from blocking search engines |
| DNS | Edit | SPF/DMARC records and search engine verification records |
| Cache Purge | Purge | Flush the cache after we ship a change |
| Analytics | Read | Crawler and traffic data for your weekly report |
The token cannot touch other zones in your account, billing, members, Workers, Pages, or anything not listed.
Option B: keep DNS where it is
Nothing to hand over. When a record is needed (usually two or three in the first month) we email you the exact name, type and value to paste in. Some providers let you invite us as a delegate user so we can add them ourselves; that is optional.
Option C: move DNS to our Cloudflare account
The least work for you and the biggest ask, so it is never the default. We add your domain to our Cloudflare account, copy every existing record across, and send you two nameservers to set at your registrar. You keep the domain; pointing the nameservers back reverses it completely. Pick this only if you have no one to manage DNS for you.
We do not ask for your registrar or DNS provider password under any option.
4. Web server
Technical fixes (redirects, image optimization, security headers, schema) get shipped to your server as files. The wizard prefers an invite (a cPanel or hosting-panel user, or an SFTP account limited to the site's folder) over a shared password. What you give us is scoped to the one site; if your host offers a per-site SFTP user, use it.
Every change we ship is recorded against the recommendation that asked for it, so you can see what was touched and when from your dashboard.
5. CMS admin
Where the site runs on WordPress, Shopify, Webflow or similar, on-page changes (titles, descriptions, content, publishing) happen through the CMS. We ask for an Editor or Administrator user created for us, not your own login, so it can be removed on its own. Publishing without approval only happens if you said yes at the permissions step; otherwise drafts wait for you.
6. How credentials are stored
- Every token, key and password is encrypted at rest (AES-256) in the application database. The key is not stored with the data.
- Credential values are never written to logs, error reports or emails.
- Google access is by OAuth token, never your password. Tokens are stored encrypted and refreshed automatically.
- Only the production application and the person doing the work can decrypt a credential. Nothing is shared with a third party that does not need it to do that work. The full list is in the privacy policy's subprocessor table.
7. What we never ask for
- Your Google account password, or any Gmail, Drive, Calendar or Contacts permission.
- Your registrar or DNS provider login.
- Access to Cloudflare zones other than the one domain, or to account-level settings.
- Your personal CMS login. We ask for a separate user.
- Payment or banking details beyond the Stripe checkout, which we never see in full.
8. Revoking access
- Google: myaccount.google.com/permissions, remove ConceptSEO. Takes effect immediately, and the app treats the account as disconnected on the next sync.
- Cloudflare token: My Profile, API Tokens, delete the ConceptSEO token.
- Nameservers (option C): point them back to your previous provider at the registrar.
- Server and CMS: delete the user you created for us.
- Everything at once: cancel from your dashboard and every stored credential is deleted within 30 days, sooner on request.
Questions about any of this: seo@concept211.com.