Diagnosis vs remediation
Audits and findings are reviewed before consequential changes. A warning, score or possible issue is evidence to investigate—not automatic permission to delete content, rewrite URLs or change production configuration.
Security & Trust
Security, privacy and production-change boundaries for TopNotch products and services.
Trust should come from clear operating boundaries, not vague badges. This page explains how TopNotch separates diagnosis from remediation, enquiry forms from secrets, public downloads from private paid delivery, and product checkout from general support.
Trust model
Practical boundaries we keep separate on purpose.
The safest workflow is often the one that prevents a diagnostic finding, support message or marketing claim from becoming automatic permission to change a live system.
Enquiry forms vs secrets
Contact and demo forms are for business context. Do not send WordPress passwords, hosting credentials, API keys, full licence keys or payment details through ordinary form fields.
Checkout vs general support
Where a product provides a checkout, payment details belong in that checkout path. General support and demo forms should not be used to transmit card or payment credentials.
Public downloads vs private delivery
Public release packages may be deliberately exposed as first-party downloads. Paid/private product delivery, licensing and update access should follow the specific product workflow rather than an openly shared ZIP URL.
Evidence vs promises
Performance scores, audit improvements and case examples should be presented as dated evidence from a specific workflow—not as a guarantee that every website will produce the same result.
Access vs ownership
When hands-on work needs temporary production access, use only the access required for the agreed task and remove or rotate temporary access when it is no longer needed.
Product data boundaries
Understand where the work happens before connecting data.
Diagnostic-first WordPress review.
Site Health is positioned around local WordPress diagnostics and explainable findings. Product documentation covers the specific data-handling, licensing and update workflow.
Search Console access is optional and read-only.
The current documentation describes optional Google Search Console connectivity using the site owner’s own OAuth configuration and read-only Search Console access. Disconnect if you no longer want the integration active.
Performance changes can affect live rendering.
Cache and front-end optimization should be introduced carefully because aggressive settings can interact with themes, plugins, checkout, forms and JavaScript. Test important pages after meaningful changes.
Production access should match the task.
For SEO, WordPress, speed, migration or automation work, access requirements depend on scope. Start with non-sensitive context; agree consequential access only when the work genuinely needs it.
Payments & licensing
Use the dedicated product path for purchases and entitlement.
TopNotch Site Health Pro currently uses its existing product checkout and licensing workflow. The general contact form is not a substitute for checkout and should never be used to send payment credentials.
Site Health ProExisting PayPal checkout path
The product page presents the current paid plans and checkout flow. Pricing pages link into that same system rather than creating a competing payment path.
Licence handlingDo not send complete keys in ordinary support messages
Use masked references when support needs licence context. Product documentation explains activation, deactivation and private updates.
General enquiriesNo payment details in lead forms
Demo and contact forms are for business context, not card numbers, PayPal credentials or other payment secrets.
Production-change discipline
Protect a working site before changing something consequential.
No theme, plugin, audit score or optimization setting removes the need for controlled production work. The exact safeguards depend on the task, but the operating principle remains the same: know what is changing, preserve a rollback path and verify the important user journeys afterward.
Use a current backup where rollback mattersEspecially before database, theme, plugin, redirect or configuration work.
Change the smallest necessary areaAvoid broad cleanup or “fix everything” actions when the evidence points to a narrower problem.
Test the journeys that make money or collect leadsCheckout, forms, account/login paths, mobile navigation and critical landing pages deserve explicit verification.
Verify search-sensitive changesURLs, redirects, canonicals, robots directives and sitemap behavior should not be altered casually.
Policies & documentation
Use the policy or documentation that governs the workflow you are actually using.
The website Privacy Policy covers general site privacy. Product documentation provides more specific guidance for product data handling, licensing, setup and support.
Security & trust FAQ
Clear answers are more useful than generic reassurance.
Does TopNotch claim SOC 2, ISO 27001 or another certification?
This page does not claim certifications that TopNotch has not publicly documented. The trust model here focuses on practical operating boundaries, product documentation and controlled production work.
Should I send my WordPress password in a demo or support form?
No. Start with the site URL and problem description. If later work legitimately needs access, the scope and access method should be agreed separately.
Can TopNotch products automatically change my site?
Capabilities differ by product. Site Health is positioned as diagnostic-first, and consequential fixes should be reviewed in context. Performance tools can affect rendering, so test important pages after configuration changes.
How does the AI SEO Tool connect to Google Search Console?
The current documentation describes an optional read-only Search Console connection using your own OAuth configuration. Review the setup and privacy documentation before connecting it.
Where should I report a security concern?
Use the normal contact route with a concise description and no secrets. Do not post credentials, exploit data containing personal information or full licence/payment details in a public message.
Need context before granting access?
Discuss the scope first.
If you are evaluating a product or considering implementation work, use the demo path to understand what access is actually needed before sharing anything sensitive.
Book a focused walkthrough
Start with the problem, site URL and desired outcome. Keep credentials and payment details out of the initial message.
Book a demo ↗