---
title: "Security & privacy"
description: "Preflight checks, fail-open behaviour and a kill switch, and no data leaves your server unless you turn it on."
url: "https://tryindexplane.com/security/"
markdown: "https://tryindexplane.com/security.md"
---

# Security & privacy

Security & privacy

Preflight checks, fail-open behaviour and a kill switch, and no data leaves your server unless you turn it on.

- [Download free](https://wordpress.org/plugins/indexplane/)
- [What data IndexPlane stores and sends](https://tryindexplane.com/docs/security/)

## An SEO tool should never be the thing that takes your site down.

> “The last plugin we tried white-screened the site on activation.”

> “Legal wants to know what leaves our servers.”

> “If something goes wrong, I need one switch to turn it off.”

## Security & privacy

### Preflight, fail-open, kill switch

Preflight checks your environment before anything runs. If a check fails, your site keeps serving. INDEXPLANE_SAFE_MODE turns everything off from wp-config.php.

[Read how it works](https://tryindexplane.com/docs/getting-started.md)

### Data stays on your server

Every external service is opt-in and listed below, with what it sends.

[Read how it works](https://tryindexplane.com/docs/security.md)

### Vulnerability disclosure

A published disclosure programme with response times. Report privately and we’ll credit you.

[Read how it works](https://tryindexplane.com/docs/security.md)

## Is my data sent anywhere?

Not unless you turn it on. Every external service is listed here.

| Service | Default | What is sent |
| --- | --- | --- |
| Checks and monitoring | Always local | Nothing. Checks fetch your own site from your own server. |
| Google Search Console | Off (opt-in) | Your site URL and OAuth token, to read clicks and impressions. |
| PageSpeed Insights / CrUX | Off (opt-in) | Public URLs you choose to test. |
| IndexNow | Off (opt-in) | Changed public URLs and your IndexNow key. |
| Slack / webhook alerts (Pro) | Off (opt-in) | Incident summaries, signed with HMAC, to the endpoint you set. |
| Tracking container checks (Pro) | Off (opt-in) | Fetches your public GTM container to compare it with your policy. |
| AI assistant (MCP) | Off (opt-in) | Only what your own assistant asks for, through your own account. |
| Licence check (Pro add-on only) | Pro add-on | Licence key, site URL and versions, for updates. Never in the free plugin. |
| FleetOps agent | Off (opt-in) | Signed intents only; agent only, hosted service not yet available. |
| Help links in wp-admin | On click only | The docs ID and plugin version in the URL. No site data. |
| Uninstall | Data kept | Two separate settings delete SEO data and the snapshot vault. |

Found a vulnerability? Report it privately to security@teamw2s.com.

## What you can check for yourself.

- The licensing SDK lives only in the Pro add-on, never in the free plugin.
- Uninstall keeps your data unless you choose deletion; the vault has its own delete setting.
- GPL-2.0-or-later: read every line.