Your Data Stays On Your Own Site
This page explains, in plain words, where the IT Nirman plugins keep your data, exactly what they send to us, how updates are protected, and what leaves your site only when you choose to connect a service.
What do ItNirman plugins send to IT Nirman?
Only a licence check. When you activate a key, and about once a day after that, the plugin sends your licence key, your site address, and the plugin, WordPress and PHP versions to itnirman.com. Our server answers with a digitally signed response, so the licence status cannot be faked by editing the database.
No content, customers, clients, invoices, messages, analytics or visitor data are ever sent. There is no telemetry and no usage tracking.
- Sent daily
- Licence key, site address, plugin / WordPress / PHP versions
- Never sent
- Content, client, finance, message or visitor data
- Telemetry
- None
- Response
- Digitally signed (Ed25519)
- Server unreachable
- Plugin keeps working for 7 days
- Licence lapses
- Plugin pauses; nothing is deleted
Security Built In
Stored in your database
CRM records and SEO settings live in your own WordPress database on your hosting. We keep no copy.
Role-based access
CRM screens are for administrators, with a limited CRM Staff role for your team. The SEO Role Manager decides which roles may do what.
Protected actions
Every action that changes data checks the user's permission and a WordPress security token (nonce).
Encrypted credentials
Credentials ItNirman SEO stores for connected services are saved encrypted.
Signed updates
Updates are signed and their SHA-256 checksum verified, and they are accepted only from itnirman.com.
Minimal crawler data
The AI Reach Tracker stores only the name of the AI crawler that read a page, never an IP address or user-agent.
What Leaves Your Site, and When
Apart from the licence check, nothing is sent anywhere until you connect a service yourself, with your own account.
| Feature | When it is contacted | What it receives |
|---|---|---|
| Always | ||
| itnirman.com (licence check) | On activation, then about daily | Key, site address, versions |
| Only if you switch it on | ||
| Google Search Console, GA4, Bing Webmaster | When you connect them | Requests for your own reports |
| IndexNow (Bing, Yandex, Seznam, Naver) | When you publish or update | The changed URL |
| GA4 tracking snippet | On your visitors' pages | Standard GA4 page data |
| Broken Link Monitor | After you consent | Requests to sites your content links to |
| Email delivery (SMTP, Brevo, Amazon SES) | When the CRM sends email | The email you send |
| Payment gateways (Stripe, SSLCommerz) | When a client pays | Payment details for that invoice |
| Google Drive backup | When you run a backup | Your CRM backup file |
Each service has its own privacy policy. Connect only the ones you need.
Habits That Keep Any WordPress Site Safe
No plugin can protect a site that is poorly maintained.
- 01
Keep everything updated
WordPress, your theme and every plugin, including ours.
- 02
Keep tested backups
A backup you have never restored is only a hope. Test one now and then.
- 03
Protect logins
Strong unique passwords and two-factor authentication; remove access the day someone leaves.
- 04
Guard your licence key
Treat it like a password. If it leaks, ask us to move it.
Report a Security Concern
Tell us privately through the contact page and do not post details publicly. Include the plugin, its version and clear steps to reproduce.