Integrity & Standards
Trust & Methodology Framework
How RankPilot AI collects data, audits web properties, evaluates search opportunities, and preserves client security.
1. Safe Crawler Mechanics & SSRF Protection
RankPilot AI uses an in-house lightweight crawler built on safe Node.js fetch and Cheerio DOM parsing. Our crawler enforces:
- Strict URL validation (HTTP/HTTPS schemes only; standard ports 80 and 443).
- DNS pre-resolution IP checking: blocks loopbacks (127.0.0.1, ::1), private RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and cloud metadata services (169.254.169.254).
- Robots.txt compliance and conservative request throttling (400ms delay between requests).
- Conservative sample caps (25 pages per audit in development mode, depth limit of 2).
2. Proprietary Scoring Disclosures (SEO, GEO, AEO)
Our health scores are calculated using transparent formulas:
- SEO Score (0–100): Evaluates verified technical health, crawlability, canonical compliance, metadata lengths, and heading hierarchy.
- GEO Score (0–100): Evaluates brand entity presence, author credential markup (Schema.org Person), and structured transparency. It is not an official search engine ranking factor.
- AEO Score (0–100): Evaluates direct Q&A formatting and concise answer summaries for conversational assistants.
3. Read-Only AI Guardrails & Prompt Injection Protection
The RankPilot AI orchestrator is strictly read-only. It cannot modify client websites, edit live CMS databases, or alter robots.txt. Webpage HTML is treated strictly as untrusted data, preventing prompt injection attacks from overriding system logic.
4. Multi-Tenant Data Isolation (Row Level Security)
Every database query is strictly scoped to your agency's organization ID via PostgreSQL Row Level Security (RLS). Users from one agency can never access, view, or modify data from another agency.