Security best practices for your team

Summary#

Some of what protects your Metric Vault account is ours to run. The rest is yours, and this page is that half: the handful of habits that account for almost every avoidable exposure we see. Read How we protect your account first for what the platform does on your behalf, then use this as the checklist for what you do.

Four things carry most of the weight. Your password is your whole credential. Team seats grant real access and nothing removes them for you. A share link is published, not private. An API key is a production secret with no scopes.

Purpose#

Most security guidance fails because it is generic. This page is specific to how Metric Vault actually works, including two behaviors that surprise people: two-factor authentication is not available today, and a share link with no expiry stays public forever. Both are manageable once you know, and expensive if you assume otherwise.

If you are the account owner or the person who answers your company's security questionnaire, this is the page to work through and hand on.

Overview#

How it works#

Sign-in and passwords#

Two-factor authentication is not available on Metric Vault accounts today, and the Security tile on the Account screen says so honestly rather than implying otherwise. That makes your password the whole of your account security, so treat it that way.

• Use a long, unique password from a password manager. Not a variation of one you use elsewhere. A password reused from a breached site is the most common way any SaaS account is taken.
• Or sign in with Google and enable two-factor on the Google account. This is the strongest option currently available, because it borrows Google's own second factor. If you go this route, protect the Google account accordingly.
• Never share a login. A shared account cannot be attributed, cannot be revoked for one person, and puts credits on an unnamed spender. Invite a teammate instead. See Inviting teammates.
• Change the password immediately if you suspect it has been exposed, and then run Log Out All. See Changing your password.

Failed sign-ins all return Invalid email or password, whatever the actual cause, so the message is not a signal about your account. If you cannot get in and the password is right, check that you confirmed the address from the sign-up email.

Sessions and shared devices#

Each browser holds its own session, so signing in on a laptop does not sign you in on a phone. There is no list of active devices and no way to end one session in particular.

• Log Out on the sidebar or the user menu ends the session in the browser you are using.
• Log Out All, on the Account screen under Security, ends every session for the account on every device at once. This is the correct response to a lost laptop, a departing employee who had the credentials, or any suspicion at all.
• Sign out of shared or public machines when you finish. See Sessions and signing out.

There is no administrator action that signs a customer out. The account holder runs Log Out All themselves.

Team seats and offboarding#

An accepted team member sees your monitored URLs, rank alerts, scheduled reports, shared analyses and branding, and can run tools that spend your credits. That is the point of a workspace, and it is also why the list needs reviewing.

• Review the team list on a schedule, quarterly at minimum. Every accepted member is a live grant. See Seats and plan limits.
• Remove leavers the day they leave. Removing a member ends their access to your workspace on their next request. Their own Metric Vault account continues to exist, which is correct: you are revoking access to your workspace, not their account. See Removing a member.
• Clear pending invitations you no longer expect to be accepted. Invite links do not expire, so an invitation sent months ago to an address that has since changed hands is still live. A pending invitation also occupies a seat.
• Send invite links privately. Anyone who has the link and the invited email address can accept it. Do not post one into a shared channel or a ticket.
• The workspace role badge is descriptive. Any accepted member has the same access to the workspace regardless of the badge shown. The one role with enforced limits is the blog role. Plan your team on that basis rather than assuming a viewer is read-only. See Roles and what each can do.

Share links#

A share link is public by design. It has no password, no sign-in, and anyone holding the URL can open the report. Treat creating one as publishing.

• Set an expiry on anything client-facing or commercially sensitive. If you do not set one, the link never expires.
• Delete links you have finished with. Deleting a share removes the stored copy of the report behind it.
• Do not share the URL where it can be indexed or forwarded. Send it directly to the person who needs it.
• Use an export instead when the content should not be on the open web. A PDF or Excel file you email is not a public page. See Exporting results.
• Check the branding on anything you send to a client, so a share page carries your identity rather than ours. See White-label reports.

Every share link you have created is listed in the app, so an audit is quick. See Sharing a result by link.

API keys#

Keys are an Enterprise capability, and each one is a bearer credential with no scopes, no expiry and no source-address restriction. Anyone holding a key can call the analysis endpoint and spend your credits until you revoke it.

• Store keys in a secret manager, the same place you keep database passwords. Never in a repository, in client-side JavaScript, in a spreadsheet, or in a ticket.
• One key per consuming system. Without scopes, limiting what each key is wired into is the only way to limit what a leak reaches. It also makes the last-used timestamp meaningful.
• Rotate on a schedule. Create the new key, deploy it, confirm the new one is being used, then revoke the old. Five active keys are allowed at once and revoking frees a slot, so rotation needs no downtime.
• Revoke instantly on any suspicion. Revocation takes effect on the next call and costs nothing. There is no reason to wait for proof.
• Never screenshot the key list. The masked display still shows the last four characters of a live key.
• Watch usage. A key that suddenly starts being used, or one that has never been used, both deserve a question. See API keys and API key security.

Integrations, webhooks and alert recipients#

• Disconnect what you no longer use. A connected Google or social account holds an authorisation for as long as it stays connected. Disconnecting removes it. See Disconnecting an integration.
• Treat a Slack or generic webhook URL as a secret. Anyone with it can post into that channel. Rotate it in the receiving system if it has been exposed, and update it here. See Competitor monitor.
• Check where alerts are addressed. A monitored URL or rank alert can notify a specific address. Make sure it is not a personal inbox belonging to someone who has left, or a distribution list wider than you intended.
• Review scheduled reports for the same reason: each one has a recipient.

What you put into the product#

• Do not paste credentials, personal data or anything confidential into tool inputs or the assistant. Content you submit for analysis is sent to the relevant provider, which is exactly what makes the tools work. That is also why it should be the domain, keyword or copy you meant to analyze and nothing else.
• Free tools are public and unauthenticated. Use them for what they are.
• Subprocessors and data flow sets out precisely what each provider receives, if you need to be exact about it.

Keeping what matters#

Saved results are deleted 90 days after the run that produced them, automatically and permanently. Nothing else expires, but nothing warns you either.

• Export anything you need beyond 90 days, at the time you produce it.
• Export before you close an account or a client engagement. See Exporting your data and Data retention and deletion.

If something looks wrong#

Work down this list in order. It goes from fastest and most effective to slowest.

1. Run Log Out All. It ends every session on every device immediately.
2. Change the password, to a new one from a password manager.
3. Revoke every API key. Reissue afterwards, one system at a time.
4. Review the team list and remove anyone you do not recognize or no longer need, including pending invitations.
5. Review share links and delete any you did not create or no longer want public.
6. Rotate webhook URLs in the receiving systems.
7. Disconnect integrations you are unsure about, then reconnect deliberately.
8. Check usage for spending you cannot account for. See Tracking your usage.
9. Contact support with what you found. Contacting support lists the routes.

If you have found a vulnerability rather than an account problem, write to hello@metricvaultai.com with the subject line Responsible Disclosure - [Brief Description]. We acknowledge reports within two business days.

For the person answering the security questionnaire#

How we protect your account covers the platform-side controls and is honest about what is not available. What data we store is the data map, Subprocessors and data flow the vendor list, Data retention and deletion the retention schedule, and GDPR and compliance the compliance position and the request routes. If your assessment needs a signed document, a completed questionnaire or an attestation, ask hello@metricvaultai.com rather than inferring one.