For AI agents: a documentation index is available at /llms.txt
Trust and data
Trust and data handling
WorkPods, an AXO (agent experience optimization) and GEO agency with SEO underneath, keeps client data in its own infrastructure. Access is role-based, every approval is logged, visitor IP addresses from server logs are never stored, and a data processing agreement (DPA) is available on request.
- Request arrives in your logs
- Agent checked against published IP ranges
- IP address dropped
- Daily totals kept
Cleaned batches are deleted after 14 days.
01
Keep client data in our infrastructure under your control
Four controls cover where your data lives, who can see it and who signs off on changes. They apply to every GEO, AXO and technical SEO engagement.
- Client data stays in WorkPods' own infrastructure: your workspace records, audit findings, drafts and cleaned log summaries are held there.
- Access is role-based: permissions inside your workspace depend on each person's assigned role, separating who can view findings from who can approve changes.
- Every sign-off goes into an approval log: nothing ships without your team's approval in our approval log, as shown on how WorkPods works.
- A DPA is available on request: we provide a data processing agreement whenever your legal, privacy or procurement team asks for one.
02
Verify agent logs without storing visitor IPs
WorkPods never stores visitor IP addresses from your server logs, and our test agent never submits forms or places orders on your website. Your team can measure AI agent traffic and test conversion flows without keeping personal IP data or creating fake CRM leads.
When agent analytics reads Cloudflare (Worker or Logpush), Vercel log drains, or uploaded nginx and Apache logs, three rules apply:
- For Observed agent visits, each log entry is Verified inside published IP ranges, Mismatch outside them, or Unverified without published ranges.
- Coverage in days of logs received is always shown, and "no fetch observed in covered logs" is never stated as "never fetched".
- We discard the visitor IP address right after the range check and keep only daily totals plus cleaned log batches for 14 days.
When we test agent-ready websites, the agent runs 3 to 5 tasks your team confirms, such as finding pricing or booking a demo. It reads form labels and WebMCP markup (an emerging standard for browser-agent tools) and records the step where each task stopped. It never submits a form or buys anything, so no test lead or order reaches your systems.
Questions
Questions buyers ask
Where is our company and workspace data stored?
Client data, including audit findings, drafts and patches, stays in WorkPods' own infrastructure. Inside your workspace, access is role-based, so each person sees what their role allows. Every deliverable goes through the approval log, which shows your team what was proposed and who approved it.
Do you store visitor IP addresses when we connect Cloudflare, Vercel or server logs?
No. Visitor IP addresses from your logs are never stored. Across Cloudflare, Vercel, nginx or Apache logs, we mark each bot request Verified, Mismatch or Unverified against published IP ranges and discard the IP immediately. We keep only daily totals and 14-day cleaned batches.
Why do you keep cleaned log batches for only 14 days?
Keeping cleaned log batches for 14 days lets operators verify which pages AI agents fetched and spot HTTP errors or redirects served to bots. It also lets us report your exact log coverage in days received. After 14 days, only daily totals remain for trend reporting.
Are you SOC 2 or ISO certified?
No. WorkPods does not hold SOC 2 or ISO certification and makes no certification claims. We state only the controls in place today: our own infrastructure, role-based access, an approval log, no visitor IP storage, and a DPA on request.
Can we review and sign a Data Processing Agreement (DPA) before working together?
Yes. A data processing agreement (DPA) is available on request for your legal, privacy or procurement team to review before you start an engagement. You can also test our work first through the free audit without connecting log sources or sharing internal data.
What access do we need to grant for the free GEO and AXO audit?
None. The free audit needs no system access, analytics credentials or server logs. The request form asks only for your work email and your website URL. Our operators check your public site files, HTML, forms and AI answer citations and send the report within 3 working days.