Security and data handling

Every response carries a Strict-Transport-Security header, so browsers keep using HTTPS. Pages cannot be framed by other sites, browsers are told not to guess file types, the Referer header is limited, and camera, microphone and location access are switched off.

• You sign in with an email address and password, or with Google. An email address must be confirmed before audits can run.
• Sign-up, sign-in and password reset use a Cloudflare Turnstile bot check.
• Routes that cost money or send email, such as starting an audit, are rate limited per address. The limit is kept per server instance, so it slows a script down but is not a full defence against a large distributed attack.

When you connect a project tool, the access token is stored encrypted with AES-256-GCM. The key lives only in the server's environment, not in the database, so a copy of the database alone does not expose a usable token.

The members of your workspace can see them. Our team can also open an audit when we need to, for example to fix a problem or help you with a report, and we record when that happens.

The AI and search providers that answer your audit questions receive the questions and your brand name, not your account details. Payments are taken by our payment provider, which acts as the seller of record. It receives your card and billing details and we do not. We do not sell your data or use it for advertising.

• Privacy
• Terms

• No SOC 2 report.
• No SSO.