Security
Last updated: 20 October 2026
How DecayQueue gets access to your sites, what it stores, where, and how to take access away. DecayQueue is built and run by W System. Questions or a security report: hello@decayqueue.com. We don’t hold security certifications, so this page says plainly what we do.
Search Console: read-only
- You add our service account
dq-gsc-reader@decayqueue-autopilot.iam.gserviceaccount.comto your property as a Restricted user. Full user works too. Only an Owner of the property (verified or delegated) can add users. - We read pages, search queries, clicks, impressions, click-through rate and average position. We can’t change anything in Search Console.
- Revoke: Search Console → Settings → Users and permissions → the service account → Remove access.
WordPress: an Editor user, drafts by default
- DecayQueue connects as a WordPress user with the Editor role, using an Application Password (WordPress 5.6+, HTTPS only). We recommend a dedicated user such as
decayqueue-editor. An Administrator account works but gets a warning, because it would give us more access than we need. - What it does: reads your posts and pages, creates and updates its own drafts, backs up the original before a refresh, and publishes only after you approve (or automatically, if you switch on auto-publish for that site). Live posts aren’t changed until you approve the refresh, unless auto-publish is on for that site.
- What an Editor can’t do: install or change plugins and themes, change settings, or manage users. Editors can see comments, so commenter names and emails are visible to that account; DecayQueue doesn’t read or store them.
- The Application Password is encrypted at rest with AES-256-GCM, bound to the site it belongs to, with the key held as a server secret outside the database. It is decrypted only to make a request to your site.
- Revoke: WordPress → Users → the DecayQueue user → Application Passwords → Revoke (or delete the user). Removing the site in the app also deletes the stored credential.
What we store, and where
- App database (Cloudflare): your account (password stored as a salted PBKDF2-SHA-256 hash, never in plain text), sites and settings, the encrypted WordPress credential, the weekly queue, drafts, backups of refreshed pages, and reports.
- Engine server (operated by W System): Search Console snapshots, copies of pages being refreshed, drafts, quality-check results and backups.
- AI provider (OpenAI API): receives the page content and search data needed for a draft or a check. Under OpenAI’s API terms, business data isn’t used for model training by default.
- Free decay check: the result is deleted after 30 days. Service data: deleted within 90 days after the last measurement report, or sooner on request.
How it’s protected
- HTTPS everywhere, with HSTS and a strict Content Security Policy on the app.
- Every site is separate: its own data, queue, drafts and settings, scoped to your account.
- A publish guard in the engine refuses to publish without your approval unless auto-publish is on for that site.
- Content is AI-written and checked automatically; nobody at W System reviews it by hand.
Sub-processors
| Sub-processor | What for | Data |
|---|---|---|
| Cloudflare, Inc. (USA; global network) | Hosting of decayqueue.com and the app; app database (accounts, sites, encrypted WordPress credentials, queue, drafts, reports); security logs | Account and site data, page content and drafts, Search Console figures |
| Google LLC / Google Ireland | Search Console API (reading your data with our read-only service account); Google Workspace email for hello@ and outreach | Search Console figures; business email correspondence |
| OpenAI, L.L.C. (USA) | AI model provider: drafting, the automated source check, the quality gate, AI-answer visibility checks, support and outreach email drafting | Page content, search queries and figures for the page; business contact data in correspondence |
| SerpApi, LLC (USA) | Search lookups to find primary sources for a draft and to check Google AI Overviews for tracked questions | Search phrases only (no personal data) |
| Resend, Inc. (USA) | Sending app emails (sign-up confirmation, password reset, weekly digest, free-check results) | Name and email address, email content |
| Stripe Payments Europe, Ltd. (Ireland) | Card payments, subscriptions, invoices and VAT calculation (Stripe Tax) | Billing contact, company and VAT details; card data is handled by Stripe only |
| Hetzner Online GmbH (Germany) | Hosting of blog.decayqueue.com | Blog visitor server logs |
| Web3Forms (form delivery) | Delivering the contact and custom-quote forms to our inbox | What you type into the form |
| W System engine server | The weekly analysis and drafting runs on a server operated by W System | Search Console snapshots, copies of the pages being refreshed, drafts and backups |
Contract terms for personal data: Data Processing Agreement. Privacy: Privacy Policy.