Security and reliability.
Ooky sits between your site and the crawlers that read it, so the questions worth asking are narrow: what can reach a crawler, what happens when we are unavailable, and how the software gets to you. This page collects the answers already published across the product pages and links to the terms behind them.
Everything below describes how Ooky works today. Where something is planned rather than available, it says so.
If the Ooky application goes down, your site doesn't.
Ooky prepares your published pages before a crawler asks for them. Managed Full DNS serves them from edge storage, and the other integrations use their own documented delivery and fallback paths. When no approved page is ready for a request, that request falls back to your site.
This is a property of the design rather than a service commitment. An SLA is part of the Enterprise plan.
What a crawler is allowed to receive.
An AI-ready page is built from your own visible content plus reviewed public facts. Before it can be served it has to match the page a person sees. These are the published thresholds, not a summary of them.
- ≥95% Content match
- For a page with a captured source, at least 95% of the distinct normalized content tokens in its AI-ready version must also appear on the visible page.
- ≥10% Additional overlap check
- A separate sanity check that helps catch empty output or content compiled from the wrong page.
- Held The default on failure
- A page that fails is held. An authorized person can accept that exact version as a labeled, audited exception; otherwise the integration uses its documented fallback.
A page with no captured source is marked unverified rather than passed. Separately, a do-not-infer instruction can be included with compiled page data when a missing value must stay unknown, so an absent fact stays absent instead of being guessed.
How the software reaches you.
The parts you install, the credentials you create, and the records you keep.
- 01
The SDK is published through npm trusted publishing.
The @ooky/sdk package is published with npm trusted publishing and ships a software bill of materials for every release, so you can check what you are installing before it reaches your build.
See the integration options - 02
Credentials are limited to what the integration needs.
Setup uses limited-access credentials rather than broad account access. Which credentials you create at all depends on the delivery method you pick, and three of the four require no Cloudflare account.
Compare delivery methods - 03
Crawler records are first-party and server-side.
Requests from recognized AI crawlers are logged from your own edge rather than through a third-party browser tag, so the record does not depend on client-side script execution.
See what gets recorded
What we do not have yet.
Two things buyers ask for early are not available today, and we would rather you find that out here than in a procurement call.
- SOC 2 Type II
- Not held today. Our Data Processing Addendum commits to sharing current security certifications and reports under NDA when available.
- SSO (SAML / OIDC)
- On the Enterprise roadmap, alongside API access for programmatic intelligence updates. Talk to us about your timeline.
Terms and data processing.
The documents that govern all of the above.
Have a question this page doesn't answer?
Security reviews, procurement questionnaires, and architecture questions all reach the same place. We answer them ourselves.