What happens to your client's data in CipherProof

A pentest report is among the most sensitive documents a client owns: it describes how to get in. If you put one into a hosted tool, you are entitled to know exactly what happens to it. This is the plain version. The full list is on the Security page.

Where it lives#

Projects, screenshots, scanner files and the database are stored on one virtual server in the European Union, rented from Contabo. They are not copied to other services. The site and the app use HTTPS only, and the app sits behind Cloudflare, which carries the traffic and ends the encrypted connection, so it does see requests as they pass.

Who else handles data#

• Contabo runs the server.
• Cloudflare handles DNS, web traffic and email forwarding for our own addresses.
• Resend sends the emails we send you, such as the confirmation link. It receives your address and the text of those messages, never your reports.
• Lemon Squeezy takes card payments for Pro and acts as the seller of record. We never see card numbers.

There are no analytics or advertising services on the site or in the app.

Who can open your account#

Passwords are stored as scrypt hashes, so we cannot read them. Every account must use two-step sign-in with an authenticator app, and it cannot be turned off. Sessions live in a cookie that scripts on the page cannot read, and repeated failed sign-ins are slowed down. Each account is separate: projects, library and scanner results belong to one account and are never shown to another.

What happens when you delete#

• A deleted project waits in Recently deleted for 7 days in case it was a mistake. Only your last 5 deleted projects are kept. Then it is erased for good.
• Deleting your account erases every project, screenshot and setting immediately.
• Backups are taken every night and kept for 14 days, so a deleted project can remain in a backup for up to two weeks after it is erased from the app.

What we do not have yet#

We have no independent audit or certification such as SOC 2 or ISO 27001. Backups live on the same server and are not yet copied to a second location. Project files and the database are not encrypted separately at rest. We would rather say so than let you assume.

Put less in the report#

The safest data is the data that was never uploaded. Before you add a screenshot, cover tokens, cookies and anyone's personal details; the screenshot editor is there for that. Use a client code name where the client's real name is not needed. If you find a security problem in CipherProof itself, write to [email protected]; good reports go on the Hall of Fame.