# Semrush

> Brings keywords, rankings, technical site errors and third-party backlinks together in one interface and, through the retrofitted AI modules, also measures whether and how a brand shows up in answers from AI systems.

- Vendor: Semrush Inc., Boston (Delaware), owned by Adobe since 28 April 2026
- Canonical URL: https://www.convios.com/en/toolbox/semrush
- Language version: https://www.convios.com/de/werkzeugkasten/semrush
- Area: Content & web · Cluster: search visibility
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-08-18 · Reviewed: 2026-08-18 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: Without measuring rankings and backlinks you notice too late that a demand channel is drying up, and you steer content by feel. With it you have not yet won a single extra enquiry. The data comes from public sources, the interface sits in almost every marketing department, and competitors buy the same one. The edge only comes from what you change afterwards in the content and in which sources cite you. Since the Adobe acquisition closed on 28 April 2026 a second question applies that appears on no feature list: which parts of the offering will keep being developed on their own, and which will be folded into a group product line.

## Suitability by company size

- Solo: suitable with caveats — Entry is 139 US dollars a month for five monitored domains and 500 keywords tracked daily, or 117.33 paid annually. That pays off as soon as search brings enquiries at all. Anyone selling through network and referral is paying for reports nobody turns into work. Each additional seat costs from 45 US dollars on top.
- Mid-market: suitable — Pro+ covers 15 domains and 1,500 keywords for 299 US dollars, Advanced adds share of voice and the data interface for 549. At this size there is usually someone who turns the numbers into editorial work. Without that person it stays a report. Per-seat charges add up faster than the step into the next plan.
- Enterprise: suitable — Single sign-on, role management and an auditable log exist only in the Enterprise offering, which carries no list price and runs through sales. The security page names the United States as the location of service data, and no European region is offered anywhere. For public competitive data and your own keywords that is workable. For the connected analytics accounts and the AI features it belongs in the vendor assessment.

## Vendor staying power

Established: The vendor has belonged entirely to Adobe since 28 April 2026 and was listed on the New York Stock Exchange until then. Corporate ownership answers the question of longevity. What stays open is which parts of the offering keep being developed on their own and which move into a group product line, and with an acquisition four months old that is exactly the point to settle in writing at purchasing.

- Acquisition agreement: Announced on 19 November 2025, 12.00 US dollars per share in cash, an equity value of roughly 1.9 billion US dollars (source: https://news.adobe.com/news/2025/11/adobe-to-acquire-semrush, as of 2026-08-18)
- Closing of the acquisition: Completed on 28 April 2026, Semrush has traded as an Adobe company since then, and the vendor announces continued development of the offering (source: https://news.adobe.com/news/2026/04/adobe-completes-semrush-acquisition, as of 2026-08-18)
- Contracting entity and governing law: Semrush Inc., a Delaware corporation with its principal place of business at 800 Boylston Street, Suite 2475, Boston; for customers in the European Economic Area the terms are governed by Irish law with venue in Dublin, terms of service last changed on 19 February 2026 (source: https://www.semrush.com/company/legal/terms-of-service/, as of 2026-08-18)
- Upkeep of the legal documents: Privacy policy dated 13 October 2025, data processing agreement dated July 2025, sub-processor list dated November 2025, terms for the AI functionality carrying no date at all (source: https://www.semrush.com/company/legal/sub-processors/, as of 2026-08-18)

## Cost of leaving

Moderate: Cancelling itself is simple: a subscription ends with the prepaid period, and under the terms prepaid amounts are as a rule not refunded. What costs you is what is missing after the export. Visibility scores, position histories and the histories of the tracked AI prompts are this vendor's own metrics, and with the next tool the time series restarts at zero. Add the projects, report templates and analytics-account connections built up over years. In the event of a suspension the terms promise paying customers 30 days to back up their data; for an ordinary cancellation no such period is stated there.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | yes, a separate document, dated July 2025 — A separate data processing agreement exists and becomes part of the contract through the terms of service as soon as customer content contains personal data. Getting there is the weak spot: the footer lists only the privacy policy and the terms of service, and the 39 usual addresses from /dpa to /legal/dpa all returned nothing on 18 August 2026. Anyone looking for the agreement finds it through a reference in the body text of the terms. | evidenced | 2026-08-18 |
| Storage location | United States, no European region offered — The security page states that service data sits in data centres in the United States and names Amazon Web Services, Google Cloud Platform and Digital Realty as the operators. No European region is offered anywhere, not even in the Enterprise offering. The sub-processor list additionally shows Ireland for Amazon Web Services without saying which processing happens there. | partially evidenced | 2026-08-18 |
| Subprocessors | public list of nine entries, dated November 2025 — The list names service and country for each entry, among them Amazon Web Services, Google Cloud Platform, Google BigQuery, Equinix, Amplitude, Intercom, Salesforce and Salesloft, all but one located in the United States. What stands out is who is missing: the terms for the AI functionality name OpenAI, Stable Diffusion and Midjourney as providers that user input is passed to. None of them appears on the list of approved sub-processors. The list is therefore public and dated, but visibly incomplete. | partially evidenced | 2026-08-18 |
| Third-country transfer | yes, to the United States, standard contractual clauses anchored in the contract — For transfers from the European Economic Area and Switzerland to the United States the contract incorporates the standard contractual clauses under Implementing Decision (EU) 2021/914 in the Module Two version. For the United Kingdom the International Data Transfer Agreement version A1.0 applies in addition. Under clause 17 the clauses are governed by Czech law. | evidenced | 2026-08-18 |
| Training on customer data | contractually excluded, improvement clause in the same document left open — The terms for the AI functionality exclude the vendor from training its own models on user input and expressly extend that exclusion to the third-party providers it uses. Two paragraphs later in the same document the customer grants the right to use input to improve those functions and to pass it on to third-party AI providers. What improvement without training covers is left open, and that gap costs the commitment its clarity. The document carries no date, so changes to it cannot be dated from the outside. | partially evidenced | 2026-08-18 |
| Retention and deletion | deletion or return promised on request, without any deadline — Deletion, destruction or return of customer personal data after the contract ends is promised in the agreement, on written request. No deadline is stated there, and the vendor reserves additional charges for the return. For its own data the privacy policy names only the necessity principle. Anyone who needs a deletion concept they can plan around has to negotiate the deadline into the contract. | partially evidenced | 2026-08-18 |
| Certifications | none named for the vendor itself — The security page names no certification of its own. On ISO/IEC 27001 and SOC 2 there is no statement there, on the legal pages or in the knowledge base, checked on 18 August 2026. Instead the page says all data centres hold the relevant certificates and links to the pages of the three operators. A certificate held by the infrastructure provider does not cover the vendor's own procedures. | partially evidenced | 2026-08-18 |
| EU AI Act, Article 50 | unclear — The terms for the AI functionality mention the European AI Regulation exactly once, in the obligation on the customer not to use the tool or its outputs in high-risk or prohibited systems. On its own transparency duties under Article 50 the vendor says nothing anywhere. The tool generates text for the customer and does not itself face the customer's end users, so the labelling can be applied by the operator. | partially evidenced | 2026-08-18 |
| Audit logging | only in the Enterprise offering, scope and retention left open — The pricing page lists single sign-on, team governance and audit logs only for the Enterprise offering, which carries no list price. In the feature table for the four self-service plans an audit log does not appear at all. Which events are captured, how long they are kept and whether they can be exported into your own systems is not stated publicly. | partially evidenced | 2026-08-18 |

## Cost

- Entry: Four self-service plans, all quoted in US dollars. SEO costs 139 a month for five monitored domains and 500 keywords tracked daily. Starter costs 199 and adds AI visibility with 50 prompts tracked daily plus MCP access. Pro+ costs 299 for 15 domains, 1,500 keywords and 100 prompts; Advanced costs 549 for 40 domains, 5,000 keywords, 200 prompts, share of voice and the data interface. Paid annually the four tiers drop to 117.33, 165.17, 248.17 and 455.67 a month. (as of 2026-08-18)
- Where it gets expensive: In three places. First the seats: each additional one costs from 45 US dollars a month, so a team of five nearly doubles the bill for a mid-tier plan. Second the reports, which are charged as add-ons: 10 US dollars for the basic report, 20 for the white-labelled one with the external connections, 90 for the entry in the agency directory. Third the step upwards: single sign-on, team governance and audit logs only begin with the Enterprise offering, which carries no list price and runs through sales. Anyone who needs those three for compliance reasons negotiates and does not know the price in advance.

## Three routes compared

### Ahrefs or Sistrix

Ahrefs maintains its own backlink index, Sistrix its own visibility index with a focus on the German-speaking market. Both answer the same question with different numbers, and that is the catch: visibility index, backlink count and estimated search volume are each vendor's own metrics and come from no shared source. Large organisations usually stay where they are for exactly that reason. The metric has been built into reports, objectives and agency contracts over years, and after a switch nobody can say with confidence for two quarters whether things got better or worse.

### Peec AI and the other measurement tools for AI answers

The AI-native vendors in this class emerged in 2024 and 2025 and measure only whether a brand appears in answers. According to our profile of 30 July 2026, Peec AI starts at 85 euros a month for 50 prompts; here the first tier with AI visibility costs 199 US dollars and brings keywords, backlinks and the site audit with it. Anyone who only wants the AI question answered pays less with the young vendors and gets more models and countries. Anyone who wants it alongside classic search pays once here and accepts that the young metric sits right beside the established ones, which invites confusion.

### Buy the data feed, build the evaluation yourself

Building this does not fail at the interface. Rankings, search volumes and backlinks come from a data feed you buy, because you cannot build your own index. On top of it you write a fetching service with Claude Code that writes the values into your own database daily, put the evaluation on Cloudflare Pages and log the AI query runs with Langfuse. Assuming two person-days for the first run and a daily rate of 1,200 euros, that is roughly 2,400 euros plus the ongoing data feed. After that comes operation, and that is where it usually fails: the data feed is billed per query and the invoice grows with every country and every device, the time series has to stay methodically stable over years or you end up measuring your own rebuilds, and once the builder leaves nobody maintains the query logic. Worth it only when the measurement itself is part of the product or the consulting offer.

Recommendation by size:

- Solo: First check whether search brings enquiries at all.
- Mid-market: Buy, but first name the person who turns the numbers into content.
- Enterprise: Buy, and settle storage location, audit logging and the AI sub-processors in writing before any rollout.

## Context

- Implements method: [Demand Creation vs. Demand Capture](https://www.convios.com/en/methods/demand-creation-vs-capture) — The method separates created from captured demand, and Semrush measures the capture side: which questions get asked, who is found for them and whether the channel still routes existing demand to you.
- Implements method: [The 95:5 Rule](https://www.convios.com/en/methods/95-5-rule) — The method says only a small part of a market is ready to buy at any moment, and the search volumes and prompts in the tool show how narrow that part actually is in your own market.
- Implements method: [Brand as Repeated Pairing](https://www.convios.com/en/methods/brand-as-repeated-pairing) — The method wants the name to come to mind at the moment of purchase, and the AI modules measure exactly that in third-party systems: whether a brand gets named at all for the matching question, and in what tone.
- Alternative: [Peec AI](https://www.convios.com/en/toolbox/peec-ai)
- Displaces: Looking up rankings by hand in one browser after another, Maintaining third-party backlinks in a spreadsheet, Reading visibility off the visitor count although the answer now arrives before the click

## Evidence

- Plan names, monthly and annual prices, limits for domains, keywords and tracked prompts, add-on prices for extra seats and reports, single sign-on and audit logs only in the Enterprise offering — https://www.semrush.com/pricing/seo-ai-search/ (as of 2026-08-18)
- Contracting entity Semrush Inc. based in Boston, governing law depending on the customer's location, reference to the data processing agreement, 30-day period to back up data in the event of a suspension, dated 19 February 2026 — https://www.semrush.com/company/legal/terms-of-service/ (as of 2026-08-18)
- Standard contractual clauses under Implementing Decision (EU) 2021/914 Module Two, UK International Data Transfer Agreement A1.0, Czech law under clause 17, deletion or return on request without a deadline, dated July 2025 — https://www.semrush.com/company/legal/dpa/ (as of 2026-08-18)
- Nine approved sub-processors with service and country, without a single AI provider among them, dated November 2025 — https://www.semrush.com/company/legal/sub-processors/ (as of 2026-08-18)
- Exclusion of model training on user input extending to third-party providers, usage right to improve the functions, transfer to OpenAI, Stable Diffusion and Midjourney, AI Regulation obligation placed on the customer, document carrying no date — https://www.semrush.com/company/legal/semrush-artificial-intelligence-services-terms/ (as of 2026-08-18)
- Service data in data centres in the United States at Amazon Web Services, Google Cloud Platform and Digital Realty, pointing to the data centre operators' certifications instead of its own — https://www.semrush.com/company/security/ (as of 2026-08-18)
- Announcement of the acquisition on 19 November 2025 at 12.00 US dollars per share and an equity value of roughly 1.9 billion US dollars, closing on 28 April 2026 — https://news.adobe.com/news/2025/11/adobe-to-acquire-semrush (as of 2026-08-18)
- Privacy policy with retention governed only by the necessity principle, dated 13 October 2025 — https://www.semrush.com/company/legal/privacy-policy/ (as of 2026-08-18)