Built to be handed real credentials
Agencies connect Google properties, CMS endpoints and client sites they do not own, and site owners connect their own. SiteRefiner is built around that: account-scoped data, logged admin access, contained AI agents and URLs checked before a browser ever opens them.
SiteRefiner holds Google credentials, CMS endpoints and site access on your behalf, whether the sites are clients' or your own. Every site, run and draft is scoped to one account, platform staff can only look by impersonating and every such action is logged, AI agents see only their own run, and every URL is checked before a browser opens it. Sign-in supports two-factor authentication and passkeys.
Agencies hold other people's keys. Every Google property, CMS endpoint and client site in SiteRefiner belongs to one account, is checked before use and is handled by agents that cannot see past their own run.
Scoped by account
Sites, checks, findings and content all sit under one account. There is no shared pool.
Visible admin access
Staff impersonate to see tenant data. A banner shows it and the audit log keeps it.
Contained by default
URLs are checked before use, and AI agents see only the work of their own run.
Sign-in that holds up
Sign-in supports two-factor authentication and passkeys. In production, passwords need at least 12 characters with mixed case, numbers and symbols, and are checked against known breached passwords.
Enter the code from your authenticator app, or use a recovery code.
- At least 12 characters
- Upper and lower case letters
- At least one number
- At least one symbol
- Not found in known password breaches
Passkeys and two-factor authentication sit on top of these, not instead of them.
One account, one boundary
Every site, check, finding and piece of content belongs to an account. Users belong to exactly one account, sites can be grouped into client folders, and which services an account can use is curated deliberately.
- Account admin
- Runs the account: its users, sites and client folders.
- Editor
- Works on sites, runs checks and single page audits.
- Content generator
- Runs the content pipeline where the account allows it.
- Viewer
- Reads results without changing anything.
- Super admin
- Platform staff with no account of their own. Sees tenant data only by impersonating.
New accounts start with the three Site Health services. Everything else is granted on purpose, and revoking a service deletes its schedules on every site so it stops running.
Admin access is visible access
Platform staff get no silent bypass on tenant data. To see an account they impersonate it, a banner stays pinned the whole time, and every admin action lands in the audit log.
Checked before a browser opens it
Every URL a tenant enters is opened by a real browser and passed to Google, so each one is checked first. Anything that points at internal or private infrastructure is rejected before anything opens it.
- Internal addresses
- Anything that points back at the platform itself.
- Private networks
- Addresses that are never reachable from the public internet.
- Infrastructure
- Addresses that belong to the hosting provider rather than to a website.
The check applies to site URLs, sitemaps and single page audits alike, because each one is opened by a real browser.
Agents that only see their own run
Content and narrative agents see the work of their own run and nothing else: no credentials, no other clients, no platform secrets. A hostile page in the research set cannot talk an agent into reading something it was never given.
Every stage of the pipeline works inside that boundary, so later stages see earlier work and nothing else.
Google access, scoped per site
Search Console, Analytics and Tag Manager need a Google credential per site. Whichever way a client connects, the credential belongs to that site and reaches only the properties the client has shared.
-
01
Coming soon
One-click Google sign-in
One grant connects Search Console, Analytics and Tag Manager at once.
-
02
Available
A service account
The client shares their properties with a service account, so access is limited to exactly what they chose to share. Non-technical clients only need to grant access to one address.
Conversion Funnel, Google Ads and Index Coverage need nothing extra. They work from the connections the site already has.
Long runs fail loudly
A crawl can run for hours on a slow host. A run that stops making progress is failed with a reason, never left spinning, and a retry never doubles its findings.
Scheduler
Due checks start on their own, and a second run of the same service never piles up on a site.
Stalled runs
A run that stops making progress is failed with a reason, never left spinning.
Long crawls
A crawl may run for hours on a slow host, and stops only when pages stop finishing.
Retries
A re-run replaces its findings instead of adding to them, so nothing is counted twice.
Sitemaps
One sitemap fetch serves every check on a site, so a client's host is not hit ten times over.
Runaway browsers
A browser that runs away with resources is stopped before it can affect anything else.
180 days of history, then pruned
Run history older than 180 days is pruned every night. The latest successful run for each site and service is always kept, so Insights never loses its baseline.
Questions
Where does client data live?
Under one account. Every site, check, finding and piece of content belongs to your account, users belong to exactly one account, and there is no shared pool between tenants.
Can SiteRefiner staff see my clients' data?
Only by impersonating the account, which shows a banner the whole time and is written to the audit log. There is no silent bypass.
How do clients connect Google without handing over passwords?
They share their properties with a service account, so access is limited to exactly what they chose to share. One-click Google sign-in is coming. Either way the credential belongs to that one site.
What sign-in protection is there?
Two-factor authentication with an authenticator app and recovery codes, passkeys, and password rules that reject known breached passwords.
What can the AI agents see?
Only the work of their own run: no credentials, no other clients, no platform secrets. A hostile page in the research set cannot talk an agent into reading something it was never given.
How long is data kept?
Run history older than 180 days is pruned, always keeping the latest successful run for each site and service. Enterprise plans can set a custom retention period.