Security
Evidence you can audit,
on a platform built for audit
localGEO handles the data that connects marketing to revenue: calls, leads, bookings and payments. It’s built to SOC 2 requirements and HIPAA-ready, with enterprise identity, tenant isolation and a client-readable audit trail.
- Enterprise single sign-onSAML and OIDC with Microsoft Entra ID, Okta, Ping Identity, JumpCloud, OneLogin and Google Workspace, with SCIM provisioning.
- MFA everywhereEvery person signs in with a second factor: a passkey, an authenticator app or an email code.
- Tenant isolationRow-level security on every table and per-client encryption keys, so one client's data can never reach another.
- Audit log your clients can readEvery sign-in, view, export and staff access is recorded with the reason, and clients can export it.
- Built to SOC 2 requirementsControls designed to the AICPA Trust Services Criteria for security, availability and confidentiality.
- HIPAA-readyHealth information is excluded by design, and regulated clients run in a dedicated deployment backed by business associate agreements.
- Tamper-evident evidenceEvery attributed touch carries a SHA-256 evidence hash and an idempotent event ID.
- Least-data connectorsConnectors read an allow-listed set of fields, and credentials are isolated per client and never written to logs.
What we never store
- Call recordings or what was said on a call
- Answers people type into booking forms
- Caller phone numbers in readable form
- Click IDs in readable form
- Lead names, emails or phone numbers in attribution records
- Vendor keys in logs or reports
Three ways to deploy
- Pooled: For agencies and multi-location brands: isolated per client by row-level security and per-client keys.
- Regulated: For healthcare and senior living: a dedicated, HIPAA-ready environment under business associate agreements.
- Dedicated: For enterprises that need their own environment, region and keys.
Security questions and vulnerability reports: info@localgeo.com. Placeholder: add the subprocessor list, and the SOC 2 report date once the report is issued.
Questions buyers ask
How is localGEO different from AI visibility tools?
Visibility tools measure how often an assistant mentions you. localGEO measures that too, then follows the customer through the phone call, the CRM, the booking and the payment, and gives every link an evidence tier and a confidence score. The output is revenue you can trace, not a share-of-voice chart.
Can you tell me the exact prompt a customer typed?
No, and neither can anyone else. We can prove which engine sent a customer. The likely prompt is inferred from the page they landed on, and we always label it as inferred.
How do you attribute a call when nobody clicked?
We read the phone system itself: the number that rang, a hashed caller ID matched to an AI-tagged lead, and a phone tap on your site just before the call. Each signal moves the call up or down the evidence ladder, from grade A to D. Calls with no evidence are reported as dark, never guessed.
Which CRMs and phone systems do you connect to?
Prebuilt adapters cover Zoho, Salesforce, HubSpot, Dynamics 365, GoHighLevel, Pipedrive, Open Dental, Clio, ServiceTitan, Jobber and Housecall Pro, and phone systems from Zoom Phone, Twilio, CallRail, Microsoft Teams, Webex, RingCentral, Dialpad, 8×8, GoTo and CallTrackingMetrics. Anything else connects through the connector kit by API, webhook or export.
How do you handle SOC 2 and HIPAA?
The platform is built to SOC 2 requirements and is HIPAA-ready: health information is excluded by design, and regulated clients run in a dedicated deployment under business associate agreements. Ask us for the security package.
How do agencies work with localGEO?
Agencies run their clients from one workspace with the same scoring for each, and can show a prospect the calls and revenue they're losing before they sign. Talk to us about partner terms.
AI Revenue Leakage Audit
Find the revenue your AI answers are making, and losing
A fixed-scope audit of what AI engines say about you, the wrong facts they repeat, the calls you’re missing, and the revenue you can’t trace today.