Security
How SEMRS protects your accounts and your data — including what is not yet done.
Last reviewed: 7 September 2026
We never hold your passwords
SEMRS does not ask for, store, or accept a platform password. Access to your accounts is granted through each platform's own partner or manager mechanism — Google Ads Manager, Meta Business Manager, TikTok Business Center, a WordPress application password you generate. You grant it, it is scoped to the work, and you can revoke it yourself at any time from that platform's own settings without contacting us.
Credentials at rest
Where a client voluntarily provides an access token, it is encrypted at rest with AES-256-GCM— an authenticated cipher, so tampering is detected rather than silently accepted. Tokens are used only for the task they were granted for and are never reused across clients or repurposed.
Sessions
Staff and client sessions use signed, HTTP-only cookies validated on every request by the server, not by the browser. Client Portal accounts are individual and scoped: a signed-in client can only ever read their own orders, drafts, leads and invoices.
Separation between clients
Every query that returns client data is scoped to that client's own account. One client's brief, drafts, approvals, message log and leads are never visible to another, and lead data is never resold, reused across clients, or fed into SEMRS's own marketing.
Defences against common attacks
Inbound lead webhooks validate the sender's signature before the payload is trusted, so a spoofed request cannot inject a fake lead. Any feature that fetches a URL checks it against an allowlist built from our own database and rejects private and link-local address ranges, so the server cannot be aimed at an internal host.
An audit trail that cannot be quietly edited
Approval decisions and the client message log are append-only. A correction is a new, separately dated entry — nothing is overwritten. That is what makes it possible to say honestly what was approved, by whom, and when.
What is not done yet
Stated plainly rather than left for you to discover: our public forms (newsletter and enquiry) have no rate limiting yet, so they could be flooded with junk submissions. Staff currently share one login rather than holding individual accounts, which means the audit trail names the system, not the individual. Both are known and on the list; neither exposes client data.
Reporting a problem
If you believe you have found a security issue, email admin@semrs.com. Tell us what you found and how to reproduce it. We will confirm receipt and will not pursue anyone who reports a genuine issue in good faith.
This page describes how SEMRS actually operates. It is written to match this system's documented practices rather than generic boilerplate, but it is not legal advice, and a qualified review is recommended before relying on it in a dispute.