Your account
Passwords are stored only as salted hashes, never as text. New accounts confirm their email with a one-time code, and you can sign in with Google instead of a password.
Sign-in, sign-up and password reset are rate limited to slow down guessing.
Your content and reports
A report can be opened only by the account that created it. Anyone else gets “not found”, including other customers.
What your package unlocks is decided on our servers for every request. Locked detail is never sent to the browser and hidden, so it can't be revealed by inspecting the page.
Payments
Payments are handled by Paddle, our merchant of record. Card details go straight to Paddle; Rankbist never receives or stores them.
Every billing message from Paddle is verified with a signature before it can change a subscription.
Google Search Console
The connection is read-only and limited to sites you have verified. The access token is encrypted before it is stored, and you can disconnect at any time from the dashboard.
Checking live pages
When you check a URL, Rankbist refuses private and internal network addresses, re-checks every redirect, and limits how much it will download. A URL check can't be used to reach systems that aren't public.
AI features
When you ask for an AI fix, the relevant part of your content is sent to our AI provider to produce that fix. Rankbist does not train models on your content.
Found a problem?
Tell us through the contact page with enough detail to reproduce it. We read every report and reply.