// Trust & Security Report
ONE.COM INDIA PRIVATE LIMITED (Rank Math), part of group.one
WordPress SEO plugin (Rank Math SEO, free + PRO/Business tiers) plus cloud add-ons: Content AI (AI writing/optimization assistant) and the newly launched AI Visibility brand-monitoring tool; also offers free web tools (Meta Tag Analyzer, SEO Analyzer, Robots.txt Tester). Owned by group.one, which also owns WP Rocket, Imagify, RocketCDN, Termly and SocialPilot.
Certifications held
1
Maturity
Growth
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on rankmath.com“"One.com Group AB, Carlsgatan 3, 211 20 Malmo, Sweden" is designated as EU Representative and "serves as a point of contact to ensure GDPR compliance and for cooperation with supervisory authorities." Rank Math's SEO plugin also ships GDPR-relevant controls (e.g. Analytics IP anonymization under General Settings > Analytics).”
> Show 8 unconfirmed / not-held certifications
source: rankmath.comNo public evidence. No trust center, no SOC 2 report, badge, or mention found on rankmath.com, vault.rankmath.com, or in vendor announcements.
source: rankmath.comNo public evidence. No ISO 27001 certificate or reference found on any rankmath.com page reviewed.
source: rankmath.comNo public evidence found on vendor domain.
source: rankmath.comNo public evidence. Rank Math is an SEO/content tool with no BAA offering or HIPAA statement found; not marketed for regulated health data.
source: rankmath.comNo public evidence of a PCI DSS attestation. Payment processing for paid plans is not described on-site; no PCI statement found.
source: rankmath.comNo public evidence, despite Rank Math offering an AI product (Content AI, powered in part by the OpenAI API) and a new AI Visibility feature. No AI-governance certification or framework is referenced on the vendor's site.
source: rankmath.comNo public evidence; not applicable to this product category (WordPress plugin / SMB SaaS add-ons).
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
Not publicly disclosed. Legal entity (ONE.COM INDIA PRIVATE LIMITED) is based in Gurgaon, India; EU Representative is based in Malmo, Sweden. No statement of server/data hosting region was found; full privacy-policy body text could not be retrieved via automated fetch (page renders via JavaScript and only the navigation shell was accessible), so this should be manually reviewed before enterprise/EU procurement sign-off.
Content AI 'uses multiple AI models along with our own algorithms, APIs, and specialized prompts' and 'uses OpenAI API as well as other sources and customizations to generate better content' (rankmath.com/content-ai/). No explicit statement was found on whether user-submitted prompts/content are retained or used to train Rank Math's own models versus passed through to OpenAI under OpenAI's standard API terms (which by default do not train on API data). No opt-out toggle for AI data use was located. General plugin usage tracking is separate, anonymous, and opt-in/disabled by default: 'Enabling usage tracking is entirely opt-in and disabled by default' (rankmath.com/usage-tracking/), and the plugin explicitly does 'not store or process any of your Google Analytics, Google Search Console, or Google AdSense data' on its servers.
// Security controls
Third-party security audits
"We get the plugin audited by 3rd party security firms every 3 months."
rankmath.comWordPress.org repository review
"Rank Math is listed on WordPress.org where plugins are thoroughly checked by the WordPress team before listing them on the repository."
rankmath.comThird-party data handling
"[We] do not store or process any of your Google Analytics, Google Search Console, or Google AdSense data" on Rank Math servers; the plugin fetches this data via API and stores it in the customer's own WordPress database.
rankmath.comVulnerability disclosure process
Search-index-cached results reference a vulnerability disclosure timeline (acknowledgment in 5 business days, initial assessment in 14 business days) on vault.rankmath.com/info/security, but the page is JavaScript-rendered and could not be independently confirmed via direct fetch (only the page title loaded). The cached contact-email domain referenced in that search summary did not match rankmath.com, which is a red flag for possible search-summary conflation. Treat as unverified pending manual review of the live page.
vault.rankmath.comPublic CVE history
Multiple historical CVEs (stored XSS, reflected XSS, path traversal/LFI, .htaccess overwrite) have been reported against Rank Math SEO / SEO PRO by Wordfence and Patchstack over the years and patched in subsequent releases; this is typical for a widely-installed WordPress plugin (2M+ active installs) rather than evidence of unusual risk, but buyers running Rank Math should keep it updated.
wordfence.com// Products & data scope
data: Runs inside the customer's own WordPress install; reads/writes on-site content and SEO metadata. Optional, opt-in anonymous usage tracking only; does not store Google Analytics/Search Console/AdSense data on Rank Math servers.
Self-hosted alongside the customer's WordPress site; Rank Math's own infrastructure exposure is limited to license/account management and optional tracking data.
data: User prompts and draft content are sent to Rank Math's cloud service, which uses 'multiple AI models along with our own algorithms, APIs, and specialized prompts,' including the OpenAI API.
Sold as a separate/bundled subscription; no explicit customer-data AI-training disclosure or opt-out was found on the vendor site.
data: Tracks a customer's brand/website presence across AI search surfaces; in early-access launch per the homepage banner as of this review.
Newly announced feature; no dedicated privacy/security documentation found yet.
data: Customer submits a URL for one-off analysis; minimal persistent data scope.
No account required for basic use.
// What to watch
- No trust center and no SOC 2 / ISO 27001 / HIPAA / PCI DSS / ISO 42001 / CSA STAR evidence found on the vendor's own domain despite the vendor operating an AI content-generation product (Content AI) and a new AI brand-monitoring product (AI Visibility) — recommend explicit AI-governance and data-training disclosure before enterprise listing.
- Full body text of the Privacy Policy and Cookie Policy pages could not be directly retrieved (pages appear to render via JavaScript; automated fetch only returned the site navigation shell) — data residency, retention, and sub-processor details should be manually confirmed before relying on this assessment for a compliance-sensitive placement.
- A search-engine-cached summary of vault.rankmath.com/info/security referenced a vulnerability-report contact email on an unrelated domain (onetimesecret.com); this could not be verified against the live page and was excluded from graded evidence as a possible conflation artifact — needs manual re-check.
- Content AI's AI-training posture (whether customer prompts/content are retained or used for model training, and any opt-out) is not explicitly disclosed on the vendor site.
- Rank Math is a sub-brand of group.one (also owner of WP Rocket, Imagify, Termly, SocialPilot); confirm any future group.one-level trust-center or certification claims are actually scoped to the Rank Math product before crediting them to this listing.
// At a glance
Pricing model
Freemium: free WordPress plugin plus paid PRO/Business tiers; Content AI and AI Visibility are separate/bundled paid add-ons.
Self-hostable
Yes
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on ONE.COM INDIA PRIVATE LIMITED (Rank Math), part of group.one's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-08. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
rankmath.com