Built like infrastructure, not like a demo.

Your sites, keywords, and articles live in rows that only your tenant can reach.

• Postgres row-level security is enforced, not just filtered in application code.
• Data access runs through tenant-scoped policies verified in automated checks.
• No cross-tenant queries by design; the guard also blocks empty-context reads.

Secrets are encrypted at rest; sessions and keys follow platform hardening basics.

• Site credentials are encrypted with AES-GCM before they touch the database.
• Passwords are hashed with argon2id; sessions use httpOnly, SameSite cookies.
• API keys are stored only as SHA-256 digests — the plaintext never persists.

Four roles with a minimal permission matrix, enforced server-side.

• Owner, admin, editor, and viewer cover the team without sharing everything.
• Nine permission points — from tenant management to publishing — are mapped centrally, not scattered in business code.
• Billing and publishing actions require the explicit roles that own them.

Every publish is reversible, and a failure never fakes success.

• Writes are idempotent — a retried publish cannot duplicate an article.
• Every publish stores a pre-change snapshot; a >3 position drop can be rolled back with URLs unchanged.
• SEO metafields and structured data (JSON-LD) are written as part of the publish, and sitemaps stay in sync.

Scheduled runs survive crashes and never bill twice for the same work.

• Runs hold a site lock with heartbeat renewal; a crashed worker's stale jobs are recovered automatically.
• Retries reuse completed stages from the parent run — no duplicated generation, no duplicated cost.
• Cron schedules respect your timezone, skip duplicates within a site, and catch up missed runs once.

You see what every run costs, and a run stops before it overspends.

• Keyword, SERP, Search Console, LLM, and image usage are metered per run into a ledger.
• A budget gate checks the ledger before spending; exceeding the agreed scope stops the run, not your bill.
• Quota errors return structured codes with limit, usage, and reset date — no silent overage.