How we handle your data and logins

The short version

Named-individual access rather than shared logins, credentials in an encrypted manager, two-factor enforced, and access revoked within one working day when someone rotates off your account. You get a quarterly access review in writing. A mutual NDA is sent the same day you ask for one.

What we ask for, and why

Search Console and analytics as a minimum, plus CMS access if we are implementing. We ask for the lowest level that lets us do the work. If you would rather grant read-only and implement yourself, that works — it is slower, and we will say so.

If you leave

Full export first: audits, briefs, keyword maps, the complete link list and reporting history. Then access revoked and account data deleted within 30 days. It is your data and it leaves with you.

How this page was written. Researched and drafted by the RankMont strategy team, reviewed by a named editor before publication, and fact-checked against primary sources — Google Search Central documentation, Google’s Search Status Dashboard, and the named studies cited beside each figure. We use AI tools for research and first drafts, as every serious agency now does; nothing is published without a human rewriting it and an editor signing off. The full editorial and AI-use policy is at /editorial-policy/. Last reviewed 16 September 2026.