Built to inspect your store without unnecessary access.

01Read-only by default

Scanning reads publicly available storefront pages — the same pages a search engine or a visiting customer can reach. A scan never asks for a store password, an API key or any merchant credential. The crawler identifies itself, respects robots.txt, limits its request rate, caps response size and time, and never attempts a purchase.

Adding a store to a workspace does not grant write access either. From the first scan through the full report, everything Vance Rank does by default is observation.

02The scanner cannot be pointed at what isn't public

The scanning service is deliberately separated from the systems that store data and money, and it carries no database, mail or billing credentials of its own. Every request it makes is checked against safeguards that stop the scanner from being pointed at private, local or infrastructure-only destinations — and every redirect is re-checked the same way, so a public URL can’t be used as a doorway to a non-public one.

In practice this protects both sides: your store is scanned through a deliberately narrow, low-traffic path, and the service cannot be turned into a tool for probing anything a normal browser visit couldn't reach.

03Changes require your approval

Nothing writes to your store unless you approve the exact change first. For findings eligible for an automatic Fix, you see a preview of the precise modification before anything happens; the intended change is logged before it is attempted, your page is re-read afterwards, and we only call it verified when the original rule passes on your live pages.

Two honest boundaries. First, if you or your team edit the same file in the meantime, Vance Rank stops rather than restoring over your content — rollback is attempted only while the recorded version still matches. Second, not every store platform or change type is supported for writes; where a fix can't be applied for you, the finding still ships with the manual steps to close it. The store platforms supported for approved changes are listed in your workspace before any connection is requested.

04Sensitive credentials

Where you choose to grant write access for an approved fix workflow, the connection credential is encrypted at rest and is never sent back to your browser after storage. It exists so an approved fix can make the one change you signed off — nothing else reads it, and deleting the store removes it.

05Evidence integrity, stated exactly

Every finding carries a captured artifact, and each artifact is identified by a SHA-256 integrity hash with its capture time. The plain meaning: the hash proves the evidence has not changed since it was captured. It is an integrity check, not a digital signature — it proves the artifact is untouched, not who produced it, and Vance Rank does not claim otherwise. When you need to dispute or re-check a finding, the hash is the anchor.

06Your data, in short

Quick Scan results are temporary: processed and kept in memory for up to 30 minutes, never written to a store, never imported into an account after signup. What an account keeps — scan records, evidence, settings — is described item by item, with retention and deletion behavior, on the Privacy notice. Important account events — refunds, credential use — are emailed to your account address.