Security responsibilities for managed websites, SEO, AI Search Visibility, reputation and automated typed website chat.
Effective date: October 7, 2026
Scope of This Security Overview
This overview explains security responsibilities across capture 5’s managed websites, SEO, AI Search Visibility, reputation management and automated typed website chat. It also applies to optional Review Outreach when separately ordered.
The actual service, approved connections, data categories and agreed security requirements determine the safeguards needed for a client’s deployment. This page is a general overview, not a complete inventory of controls or a separate security service.
Our Data Processing Addendum governs client personal data processed on the client’s behalf. Our Privacy Policy explains information we process for our own business purposes.
Security Claims and Certifications
This overview does not claim a security certification, independent audit, penetration test, SOC report or regulatory approval. Any such claim requires current documentation identifying the entity, service, period and scope it actually covers.
A provider’s certification or report does not automatically certify capture 5 or every client website. A privacy policy, security overview or signed order does not by itself establish compliance with a regulated industry’s requirements.
Clients needing specific controls, audit evidence, a service-level agreement or regulated processing must raise those requirements before sending the affected information or ordering that scope.
Information Used to Deliver Services
Depending on the accepted scope, service information may include:
Business details, approved website copy, logos, photos, services, public contact details and authorized account connections.
Website inquiries, lead contact details, typed chat messages and configured booking information.
Public reviews, response drafts, approved responses, review-platform connections and concern alerts.
Search, website performance and connection information available through authorized accounts.
First-party customer contact information, outreach permissions and suppression records for separately ordered Review Outreach.
Client account, support, agreement, invoice and payment-related records needed to administer the relationship.
Providing information does not authorize unrelated use or public publication. Access and use must remain connected to the accepted service, lawful instructions and applicable privacy terms.
Data Minimization and Sensitive Information
Provide only information needed for the agreed work. Ordinary inquiry forms, website chat and review tools are not channels for passwords, access keys, complete payment-card details, bank credentials, government identification or confidential customer files.
Do not submit health records, protected health information, special-category personal data or other regulated information unless capture 5 has expressly accepted that processing and the required safeguards and agreements are in place.
Even contact or appointment information can be sensitive when linked to healthcare or another regulated context. A Data Processing Addendum is not a healthcare business associate agreement. Required separate agreements must be completed before the affected processing begins.
If prohibited or unnecessary information is submitted, notify us promptly so we can assess containment, access restrictions and lawful removal. Do not repeat that information in another ordinary form or chat.
Access and Confidentiality
Access to client information must be limited to authorized people and the tasks needed for the service. Authorized personnel handling client personal data are subject to confidentiality commitments or applicable confidentiality duties.
Use approved account invitations and permission settings wherever available. Client access should be proportionate to the work; granting unrestricted administrative access is not automatically necessary for every service.
Credentials that must be exchanged require an approved secure process. Enable stronger authentication where available, keep recovery details current and promptly revoke access that is no longer needed.
The exact authentication, permission and logging features depend on the relevant system and agreed deployment. This page does not represent that every connected account has identical controls.
Technical and Organizational Safeguards
capture 5 must maintain appropriate measures for client personal data under the accepted processing terms and applicable law. Measures must address unauthorized access or disclosure, loss, destruction and alteration according to the processing risk.
Depending on the deployment and risk, appropriate measures may include restricted access, secure transfers, encryption, stronger authentication, access logging, data separation, vulnerability management, protected backups, recovery processes and assessment of effectiveness.
This list describes categories of safeguards, not a claim that every listed feature is deployed in every system. Applicable security documentation or an accepted security schedule should identify the measures used for the client’s actual processing.
Differences between deployments do not reduce mandatory security duties or expressly accepted obligations.
Websites, Hosting and Forms
Website security work follows the accepted hosting and maintenance scope. Updates, permissions, forms, scripts, integrations and recovery arrangements must be assessed for the systems actually used.
Public website assets must be approved for publication. Private files, credentials and customer records must not be placed in publicly accessible pages, media folders, page source or structured data.
Forms should request only necessary information and route it to authorized recipients. Client-added scripts, plugins, tracking tools and integrations can change the site’s security and privacy requirements and should be reviewed before use.
Reasonable maintenance does not automatically include continuous security monitoring, custom penetration testing, daily backups or a guaranteed recovery time. Any specific commitment must be stated in the accepted scope.
SEO and AI Search Visibility
SEO and AI Search Visibility organize approved public business information so search systems can understand the business. Work may include page structure, internal links, business details, FAQs, appropriate schema and authorized search-account configuration.
Do not put private customer information, internal instructions, confidential records or access credentials in indexable content, metadata or schema. Public content may be copied, cached or displayed by independent search and AI systems.
Robots instructions and noindex settings are not substitutes for authentication or private storage. Search visibility settings alone do not secure confidential information.
Independent search systems control their own crawling, indexing, summaries and results. Access to search accounts remains subject to approved permissions and the account owner’s security responsibilities.
Automated Content and Data Handling
Automated assistance may support approved business Q&A, review responses, content organization and related service tasks. Client personal data must be processed only for authorized purposes under lawful instructions and applicable processing terms.
Private client or customer information is not approved for public output merely because it was supplied to an automated tool. Public responses and business content should avoid unnecessary personal information and follow the agreed review and approval process.
Client personal data must not be used for unrelated advertising or general model training contrary to the Data Processing Addendum. Requirements for provider processing, retention and access must be assessed for the actual approved tools and deployment.
Automated output can be inaccurate. Business-critical claims, sensitive responses and actions outside approved limits require appropriate oversight.
Automated Typed Website Chat
The included website chat is an automated typed experience. It is not a live human operator or a voice service. Depending on configuration, it can answer approved business questions, collect lead details, qualify inquiries and direct visitors to contact or booking options.
Chat should collect only information needed for that purpose. Visitors should not enter payment credentials, passwords, medical details or other sensitive information into ordinary chat.
Answers and links depend on the approved business information and configuration. Chat must not be treated as authorization to change prices, issue refunds, create binding commitments or perform other unapproved actions.
Clients must identify suitable escalation contacts and keep service details, booking links and approved answers current. Automated chat is not an emergency or regulated-advice channel.
Service Providers and Subprocessors
Authorized providers may support hosting, storage, account connections, email delivery, typed chat, booking, automated content assistance, analytics, security, payment processing and support.
Providers processing client personal data on our behalf are subject to the authorization, contractual protection, notice and responsibility requirements in the Data Processing Addendum. Delegating processing does not remove obligations capture 5 retains under that agreement or applicable law.
Relevant provider identities, functions and processing locations will be made available to authorized clients where required for assessment or legal compliance, through an appropriate private channel.
Independent platforms and payment institutions may act in their own capacity for some processing. Their role and applicable terms must be considered separately.
Payment Information and Authorization
Use approved payment channels for payment details and authorization. Do not send complete card numbers, security codes, bank login details or other payment credentials through our inquiry form, website chat or ordinary support notes.
An inquiry form is not a paid order or recurring-payment authorization. Service and payment authorization are handled separately through the accepted order and payment process.
Payment security involves the approved processing systems, financial institutions, client accounts and access permissions. This overview does not claim that capture 5 holds a particular payment-security certification.
Fees, payment methods, renewals, cancellation and valid payment disputes are addressed in the Billing Policy and Service Agreement.
Email and Optional Review Outreach
Active review-request outreach is a separate service. When ordered, use lawful first-party contact information and maintain the permissions and records required for the intended messages.
Purchased or scraped lists, fabricated contacts, review gating and requests designed to exclude dissatisfied customers are not approved uses. Sending must follow the applicable Email Terms and Opt-Out Policy.
Sending can be restricted when list quality, complaints, account compromise or another material risk requires it. Bounces, opt-outs and suppression records must be handled appropriately.
Clients should secure their sending domains and email accounts and verify unexpected payment or access instructions. Email delivery and inbox placement depend partly on independent systems.
Reputation and Review Platform Boundaries
Reputation services operate through supported platforms and authorized permissions. Monitoring reviews, preparing responses and publishing responses are different functions; availability depends on the agreed scope and connection.
Response handling should consider both the rating and the written context. Customer concerns may need escalation or client review. Private order details, contact information, health information and other confidential records must not be disclosed in public responses.
Independent platforms control their own authentication, moderation, publication, account enforcement and platform security. Clients remain responsible for maintaining their profile ownership and protecting their own accounts.
Platform boundaries do not eliminate capture 5’s duties for its own access, handling or agreed service work. See the Platform Disclaimer.
Client Security Responsibilities
Clients must provide lawful instructions and take reasonable steps to protect their accounts, customer information and access permissions.
Keep domain, website, review, email, booking and payment accounts secure.
Approve access only for authorized users and remove permissions when roles change.
Use secure transfer methods and provide only necessary information.
Tell us about regulated processing or special security requirements before that processing begins.
Keep business content, escalation contacts and approved connections current.
Promptly report suspected compromise, incorrect access, exposed information and relevant privacy requests.
Train staff to recognize phishing and avoid placing confidential information in public content or responses.
Each party remains responsible for its own obligations. A client-side incident does not automatically remove capture 5’s duties under law or an accepted agreement.
Security Incidents and Personal Data Breaches
When capture 5 becomes aware of a personal data breach involving client personal data, we will notify the affected client without undue delay and within any shorter deadline required by applicable law or the accepted agreement. Notice will not be delayed merely to complete an investigation or confirm every detail.
To the extent available, notice will describe the incident, affected information and individuals, likely consequences, steps taken or proposed and a contact for follow-up. Further information may be supplied in stages without undue additional delay.
We will take appropriate steps to contain, investigate, mitigate and document the breach and provide required assistance. Relevant subprocessor incidents are included in that cooperation.
Clients generally handle controller notifications to individuals and authorities. capture 5 remains responsible for any direct duties that apply to it. The parties will coordinate where appropriate and lawful.
Incident reporting does not by itself determine liability. Responsibility depends on the facts, accepted obligations and applicable law.
Retention, Return and Deletion
Client personal data processed on the client’s behalf is subject to lawful instructions and the Data Processing Addendum, including applicable return or deletion requirements when processing ends.
Information capture 5 controls for its own business purposes, such as necessary agreement, accounting, tax or dispute records, follows the Privacy Policy and applicable retention requirements. Retention must be limited to a lawful purpose and the period necessary for that purpose.
Necessary suppression records may be retained to prevent unwanted messages. Where backups apply, deletion and isolation must follow the agreed processing terms and lawful retention arrangements.
Billing disputes or unpaid balances must not obstruct mandatory privacy responses or required data return or deletion. Website handover, transferable materials and licensed assets follow the accepted service scope without overriding those duties.
International Processing and Transfers
Providing services across markets may involve authorized processing, storage or access in more than one country. Relevant locations and provider roles must be assessed for the client’s actual processing.
Where a transfer mechanism or additional safeguards are legally required, the applicable arrangements must be in place before the affected transfer. Acceptance of this overview or an ordinary order does not by itself complete every required transfer instrument.
The Data Processing Addendum and any properly executed transfer terms govern covered client personal data. Each party retains the duties applicable to its role.
Offering services in a country does not establish a local office, regulatory approval or blanket compliance with every industry requirement in that market.
Continuity, Availability and Recovery
Availability can be affected by hosting, internet connections, independent platforms, email systems, payment providers, client accounts and security events.
Recovery measures for client personal data must be appropriate to the risk and accepted processing obligations. Particular backup frequency, retention periods, restoration targets or uptime commitments apply only when documented in the accepted scope.
Work or access may be restricted when reasonably necessary to contain a material security risk. We will coordinate affected service work and follow applicable notice, privacy and contractual obligations.
This overview does not promise uninterrupted operation or restoration of every historical website version. It does not reduce an expressly accepted recovery commitment or a mandatory duty.
Security Reviews and Client Requests
Clients may request relevant information for procurement, privacy assessments or review of the security measures applicable to their service. Specify the service, requirement and information needed.
Appropriate responses may include written answers, policy extracts, relevant deployment information and required provider details. Information may be shared through a secure channel with reasonable confidentiality protections.
Reviews must protect credentials, confidential configurations and other clients’ information. Testing, scanning or access to systems requires appropriate authorization; sending a questionnaire does not authorize those activities.
These safeguards do not override audit, information, cooperation or regulator-access duties under the Data Processing Addendum or applicable law. Any separately priced custom work must be accepted in advance where permitted and must not obstruct mandatory rights or deadlines.
Security Risks and Responsibilities
No system can eliminate every risk of phishing, compromised credentials, malware, unauthorized access, provider incidents or service interruption. Appropriate safeguards, limited information and responsible access reduce risk.
Clients should evaluate whether the agreed service and documented measures are suitable for their intended use. Special requirements must be discussed before adding sensitive processing or new integrations.
The absence of an absolute security guarantee does not remove responsibility for accepted obligations, appropriate safeguards or duties that cannot lawfully be excluded.
The accepted agreement and applicable processing terms govern their respective subject matter. Mandatory law takes priority where required. This general overview does not reduce a more specific accepted security or data protection obligation.
Standard recurring service is month-to-month under the Service Agreement. This page does not create a minimum multi-month commitment, payment authorization or a new service order.
Updates to This Overview
We may update this overview to reflect changes in services, processing, systems, providers, risk assessments or legal requirements. The revised effective date will appear on this page.
Required notices and consent or authorization processes remain subject to the accepted agreement, Data Processing Addendum and applicable law. A public page update does not by itself reduce an existing contractual protection or authorize a restricted processing change.
Contact capture 5
Use our contact form for a security question, procurement review or suspected issue. Add “Security Question,” “Vendor Security Review” or “Security Concern” to the notes and identify the affected business or account.
For a suspected issue, include a brief description and when it occurred. Do not include passwords, payment credentials or exposed sensitive records. We can arrange a suitable channel for further details.
Clients with an agreed incident-reporting channel should use it for time-sensitive reports. Contact-form submission does not replace a legal notification or reporting deadline that applies to either party.
