How your access is stored and protected

Access you submit is encrypted immediately using envelope encryption (a unique key per submission, itself encrypted with a key held only in our server environment). It is never written to logs, events, or support tickets in plain text.

The credentials are used only to perform the specific change you approved, and only against your own site. All of our outbound requests are restricted to public internet addresses over HTTPS.

When your task closes, the stored secrets are purged automatically. You can also revoke the Application Password yourself at any time from WordPress.