Security

How the service protects your data and your users', and how to reach us about a vulnerability.

Report a vulnerability

Write to [SECURITY EMAIL]. We acknowledge within two business days and keep you informed until it is fixed. Please give us a reasonable time to fix an issue before disclosing it, and do not access other customers' data or degrade the service while testing. We do not take legal action against good-faith research that follows this policy.

Your data

• Where it lives: you choose a region at sign-up — United States, European Union or Asia-Pacific. Each region is a separate deployment with its own database; your data is not moved out of it.
• How long: you set the retention, from one day to ten years; data past it is deleted hourly.
• Less of it: IP addresses can be kept only as keyed digests; the account identifiers, emails, card fingerprints and phone numbers you send for an assessment are processed as keyed digests, and messages as short sketches — never stored as sent.
• Yours to take away: export it through the API, and erase one visitor or everything from the dashboard.

Secrets

API keys, session tokens and every emailed link are stored only as hashes, so reading the database does not let anyone use them. Passwords are salted scrypt hashes. Results you ask to be sealed are encrypted with your organization's key.

Access

• Roles within each organization (viewer, member, admin, owner), checked on every action.
• Two-factor sign-in with authenticator apps and passkeys, which an organization can require; single sign-on (OIDC) and SCIM provisioning.
• An audit log of every security-relevant action, readable by your admins and through the API.

The service

• TLS everywhere; security headers on the dashboard; clickjacking refused.
• Tenancy enforced in every query and tested on every change, with the detection pipeline, access control and the edge integrations.
• Independent reviews of security-relevant code; what they found and what was fixed is recorded in the repository's engineering notes.
• Built to fail safe: receipts are verified at your own edge and in your servers, and every integration lets traffic through when the service cannot be reached — an outage reduces protection; it never blocks your users.

Compliance

A Data Processing Addendum for GDPR and UK GDPR, with the standard contractual clauses. [CERTIFICATIONS: none yet — SOC 2 / ISO 27001 when obtained.]