Is Semrush safe in 2026?

Yes, I consider Semrush safe for SEO research in 2026. Review its security controls and data terms before connecting accounts.^[1][2] Adobe owns the company.^[3] Treat Google reporting and mailbox access as separate decisions.

Is Semrush safe to connect to your site?

Review the permissions and data terms for each Semrush connection.^[1][2] Its privacy policy contains no personal-data security guarantee.^[2] Keep Google reporting access separate from optional email access.

Split your decision into three checks:

• Verify the company and the account you intend to use.
• Compare its published safeguards with your business's data rules.
• Inspect the access request for each feature you connect.

Semrush's Google integration guide covers several tools, with different connection instructions.^[6] Its privacy policy also describes optional mailbox access for outreach work.^[5] Review those connections separately. A decision to connect reporting data should have its own scope, separate from a decision to connect email.

Who owns Semrush, and who runs it?

Adobe owns Semrush following the completed acquisition of Semrush Holdings, Inc.^[3] The completion announcement names Bill Wagner as Semrush's chief executive officer.^[3]

The company timeline and completion announcement agree on Adobe ownership.^[3][7] The NYSE listing is earlier company history.^[7]

Where is Semrush based?

Semrush's company history records US registration, and its privacy policy says SEMrush Inc. is based in the United States.^[7][8] Its history also records the establishment of Boston headquarters.^[7]

“Russian-owned”, “founded in Russia” and “stores data in Russia” are different claims. Adobe owns Semrush today.^[3] Semrush says it stores service data in US data centres.^[1]

For a business data review, I would focus on the legal entity in the agreement and where the relevant data can go. Nationality alone would not settle that decision.

How does Semrush protect data and accounts?

Semrush says it uses encryption, restricted staff access and security testing, and it offers customer two-factor authentication.^[1][4][9] These are company-published safeguards. Check that your account settings and agreement meet the controls your business requires.

The security page also describes a bug bounty for independent researchers to disclose flaws.^[9] Its incident policy says Semrush notifies affected users when it becomes aware of unlawful access to stored service data.^[9] Check those policies against your own requirements.

I would enable two-factor authentication before connecting business accounts. Semrush's instructions place the switch in Profile settings, under Security.^[4] The documented sign-in process sends a six-digit code to the registered email address.^[4] Include that mailbox in your account-security review.

What data does Semrush collect and share?

Semrush's privacy policy covers account details, payment information and automatically collected usage data.^[5] It also permits disclosures to service providers and affiliates under stated conditions.^[5] Review those terms alongside the data your chosen feature will handle.

The policy describes registration details such as your name, company, email address and password.^[5] It also describes transaction and payment information.^[5] Automatically collected information can include page visits, clicked links, IP addresses, browser software and operating systems.^[5] This is information about using Semrush's services, rather than a complete description of every connected site's data.

Semrush says it won't sell or otherwise provide personal data except under its stated service, permission, legal and disclosure conditions.^[5] Those conditions include service providers, affiliates, certain sales-related third parties and business transfers.^[5] Read the exceptions with the headline statement.

Which terms cover your customers' data?

Semrush's privacy policy excludes personal data it processes on behalf of business customers as a service provider or processor.^[2] It says the customer agreement governs that processing.^[2] The security page also describes data processing addenda with customers and vendors.^[1] Review the agreement and applicable addendum before approving a customer-data connection.

Does US storage mean all processing stays there?

Semrush says it stores service data in US data centres.^[1] Its privacy policy also allows personal-data transfers to group members in their jurisdictions and service providers in the United States.^[8] Treat service storage and wider personal-data processing as separate checks. Ask whether both fit your business's requirements.

What changes if you connect a mailbox?

Mailbox integration can let you compose, send, read and process outreach emails through a Semrush tool.^[5] The policy describes encrypted storage of information related only to outreach emails you send through its tool interface. That information includes message content, replies, API tokens and metadata.^[5] It places specific limits on using that data, including a ban on advertising uses.^[5] Approve mailbox access only if the outreach feature forms part of your intended work.

What should you check before connecting Google accounts?

Before connecting Google accounts to Semrush, check the feature, property permissions, consent request and customer-data terms.^[2][6] I would use the six checks below and keep a record of the access I approve.

1. Name the job. Choose the Semrush feature you need and the website or property it should analyse. The integration guide gives tool-specific instructions.^[6] Start with those instructions, rather than approving every available connection.
2. Check Google Analytics access. Semrush's guide says connecting Google Analytics requires at least Viewer access.^[6] Check which account and property your login can access.
3. Check Search Console access for the specific tool. The guide says Backlink Audit requires Owner or Full user access.^[6] Restricted users cannot connect Search Console to that tool.^[6] Check other tools separately instead of extending that requirement to every integration.
4. Read the consent request. Inspect the permissions on the live approval screen. Ask for an explanation of access beyond your intended job. Your Google account role doesn't show every permission the connection requests.
5. Review the data terms. Check the agreement, applicable data processing addendum and international-transfer provisions.^[2][1][8] Keep optional apps and mailbox access as separate approvals.
6. Plan the exit. Semrush's guide links instructions for disconnecting your Google Account.^[10] Locate the current procedure before connecting, and decide who will remove access when the work ends.

For example, say you want Google Analytics data in a Semrush report. Identify that reporting feature and property first. Check the required access, then compare the consent request with the job. A separate outreach email feature needs a separate review.

Is Semrush legit, and can its reports be trusted?

Semrush is a legitimate company with a documented history and completed Adobe acquisition.^[3][7] That confirms the company, not the accuracy of every report. Assess each report against the question it answers and the data behind it.

Semrush describes a platform combining SEO authority and AI visibility intelligence.^[7] Its acquisition announcement describes its proprietary dataset.^[11] Its Google integration guide explains how connecting Analytics and Search Console brings your website data into the Semrush interface.^[6] Identify which source a particular report uses before relying on its numbers.

I would review a report using three questions:

• Does the number come from a connected account or another data source?
• Do the property, dates and filters match the decision?
• What business action would I take if the number changes?

For your own site, compare the relevant connected data with the original account. If you need assurance about traffic-estimate accuracy, ask for the methodology and a relevant benchmark. A security review and a measurement review answer separate questions.

Where does Searchmaxxed fit?

Searchmaxxed runs agentic SEO: we build AI agents that connect to your whole Search Console and GA4. Our Managed Search Loop checks that data against your plan and picks the next job. We turn the findings into website changes, with a person approving each public change.

Our agents check competitors' sites, Google results and what AI answers say about your business every week. The Managed Search Loop uses those findings to choose the next page or fix.

We make the changes on your Agentic Website, which lives on GitHub and Vercel and belongs to you. The work includes new pages, technical fixes, schema and internal links. Schema gives search tools structured facts about your pages.

Our Off-Page Source Layer builds support on other sites through links, reviews, citations, press and mentions. The agents then measure what happened, and we use that evidence to choose the next job.

Choose the scope by the work you need. Our packages and inclusions cover:

• Local Search: service and local pages, Google Business Profile management, review work, local links and listing cleanup.
• Growth System: 30 page releases a month, technical fixes, schema, internal links, source-layer basics and AI visibility tracking.
• Agentic Search Engineering: 50 page releases a month, new comparison and industry pages, digital PR and wider AI answer tracking.
• Custom & Enterprise: agreed work across multiple markets, with engineering, reporting and first-party research where required.

Entry options include the Agentic Website Full Build, Agentic Migration and AI SEO Audit. The build covers research, structure, design, technical SEO and measurement. The migration moves a design worth keeping into an owned repository. The audit identifies gaps, ranks fixes and sets the plan.

Let's talk pricing.

Frequently asked questions