CiteTrack is local-first. Analytics, crawl logs, prompts, citation results, source evidence, tasks, reports and settings are stored in your own WordPress database. Crawler peer addresses are one-way hashed before long-term storage, while short-lived encrypted verification queues are used only to verify crawler identity.
What is encrypted
AI provider keys, Google tokens, webhook destinations and other sensitive secrets are stored in the encrypted vault. If you define CITETRACK_KEY, that value becomes the dedicated encryption secret for the vault.
What leaves your site
- License and updates: your site contacts CiteTrack to validate the license and fetch update metadata/packages.
- AI checks: when you run citation, reputation, brand, fix-guide or prompt-discovery work, your site contacts the AI provider key you configured.
- Google integrations: Search Console, GA4 and Clarity features contact Google or Microsoft only when connected.
- Alerts: email, Slack and webhook delivery contact the destinations you configured.
What does not happen
CiteTrack does not send your full local analytics database to a hosted CiteTrack dashboard, and it does not store raw visitor IP addresses as ordinary analytics data.