--- title: "Trust · gscdump" canonical_url: "https://gscdump.com/trust" last_updated: "2026-09-13T07:40:23.181Z" meta: description: "How gscdump handles your Search Console data: a read-only Google scope, encrypted tokens, open formats, no resale, no scores, and what export covers today." "og:description": "How gscdump handles your Search Console data: a read-only Google scope, encrypted tokens, open formats, no resale, no scores, and what export covers today." "og:title": "Trust · gscdump" --- # Trust Each claim on this page names its mechanism: the scope, the cipher, the storage boundary, or the recorded decision behind it. Where a guarantee is not finished, the gap is stated instead. Ledger · claim and mechanismchecked against source, 2026-08-04
webmasters.readonly
The only Google API scope requested beyond basic profile. gscdump can read Search Console; it holds no scope that can change anything in your account.
AES-256-GCM
OAuth tokens are encrypted before they reach the database. Ciphertexts are versioned, so keys rotate without stranding a stored token.
gsc-user-{id}
Your Search Console record lives in a database provisioned for you alone, not in rows of a shared table.
.parquet
Preserved history is written in open formats: Parquet and Iceberg on the platform, DuckDB and Parquet on your own disk with the CLI.
sc-domain:
A Site covers the exact registered host. Analytics totals can differ from a broader Search Console property. Source limits and sync coverage also affect comparisons.
## Your data stays yours what export covers today Analytics history is preserved in open formats: Parquet and Iceberg on the platform, DuckDB and Parquet on your own disk with the CLI. Those files stay readable with plain SQL and open tooling, without gscdump. Stated precisely: the analytics record is what you can take with you today. The sitemap and indexing record has no export path yet. That gap is tracked as named debt, and we do not turn billing on until leaving with everything, readable, takes under an hour. The CLI supports platform API keys and local Search Engine credentials. Use local mode to call Google or Bing directly. ## What gscdump never does **Resale** We never sell your data, and we never serve anyone data they are not entitled to about their own sites. No licensed keyword databases, no scraped results, nothing resold. **Verdicts** No scores, no recommendations, no fixes. gscdump serves evidence; the opinions belong to the tools built on top of it. **Your pages** gscdump never fetches, renders, or audits a page. The only documents it fetches are the sitemaps your site itself declares; everything else comes from the Search Console API. **Capture** No proprietary formats, no export fees, no telemetry used for lock-in. The hosted free tier exists to prove the platform, never to strand the CLI. ## Auth and token handling read from the OAuth handler Sign-in is Google OAuth. Four scopes are requested, and none of them can write to your Google account: openid email profile https://www.googleapis.com/auth/webmasters.readonly Access and refresh tokens are encrypted with AES-256-GCM before they are stored, using a key derived from a server-side secret. Encrypted values carry a key id, so key rotation re-wraps old tokens instead of breaking them. Revoking gscdump's access in your Google account stops sync. Jobs that hit the revoked grant abort quietly and mark the account as needing re-auth; nothing keeps retrying against a dead token. ## When a total reads lower than the GSC UI A Site covers the exact registered host, so its analytics can exclude traffic from other hosts in a Search Console property. Apply a page filter for your registered host when comparing totals. Source limits and sync coverage can also cause differences. A human stands behind every line on this page. Questions go to [~~hello@gscdump.com~~](mailto:hello@gscdump.com). Security reports go to [~~security@gscdump.com~~](mailto:security@gscdump.com); we reply and coordinate disclosure with you. [**Continue with Google **](https://gscdump.com/auth/google) [**Connect with MCP **](https://gscdump.com/mcp) ## Sitemap See the full [sitemap](/sitemap.md) for all pages.